CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-17 18:32:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

security(browse): drop .svg from the load-html extension allowlist

Browse Source 
SVG is a script-capable format (inline <script>, event handlers, foreign
objects), so allowing it through load-html's HTML allowlist let a local
.svg execute script in the browse session context. The allowlist is now
.html/.htm/.xhtml only; regression test asserts .svg is rejected.

Contributed by @garagon (PR #1153).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-14 20:21:01 -07:00
co-authored by Claude Fable 5
parent 72aff66438
commit 36c608eb6e
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/commands.test.ts
+13
View File
@@ -2304,6 +2304,19 @@ describe('load-html', () => {
}
});
test('load-html rejects .svg files', async () => {
const svgPath = path.join(tmpDir, `load-html-test-${Date.now()}.svg`);
fs.writeFileSync(svgPath, '<svg xmlns="http://www.w3.org/2000/svg"><text>hi</text></svg>');
try {
await handleWriteCommand('load-html', [svgPath], bm);
expect(true).toBe(false);
} catch (err: any) {
expect(err.message).toMatch(/does not appear to be HTML/);
} finally {
try { fs.unlinkSync(svgPath); } catch {}
}
});
test('load-html rejects file outside safe dirs', async () => {
try {
await handleWriteCommand('load-html', ['/etc/passwd.html'], bm);