[sec-check] fix: sanitize release HTML at fetch time — scripts/fetch-feeds.js (mapApiRelease, parseAtomEntry) - #1266
Open
kubestellar-hive[bot] wants to merge 1 commit into
Open
kubestellar-hive[bot] wants to merge 1 commit into
kubestellar-hive[bot] wants to merge 1 commit into
Conversation
![sec-check[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
mapApiRelease and parseAtomEntry stored release body (Markdown with inline HTML) and Atom content verbatim into static/feeds/*.json. FeedItems renders item.content via dangerouslySetInnerHTML, and the SSR branch of sanitizeHtml() returns input raw on the documented assumption that fetch scripts already sanitized it — fetch-firehose.js does, fetch-feeds.js did not. A release body containing inline HTML (e.g. <img onerror>) on projectbluefin/bluefin or bluefin-lts would be baked raw into the static docs site. Mirror fetch-firehose.js: sanitize content with sanitize-html using the shared allowlist synced with src/utils/sanitizeHtml.ts, and restrict entry link hrefs to http(s) schemes. Fixes #1265 Signed-off-by: sec-check[bot] <sec-check[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix
Files/functions claimed:
scripts/fetch-feeds.js—mapApiRelease,parseAtomEntry(plus newcleanHtml/safeLinkhelpers). Cluster: docs-site feed pipeline (static/feeds/*.json→useStoredFeed→FeedItems.tsx).Overlap check: no open PR touches
fetch-feeds.js; documentation#1263 coversfetch-registry-data.jstests only; website#806 is the same pattern in the separatewebsiterepo.What changes
mapApiRelease(GitHub Releases API,release.body= Markdown with inline HTML allowed) andparseAtomEntry(Atomentry.content= HTML) now sanitizecontentwithsanitize-htmlusing the allowlist already shared byfetch-firehose.jsandsrc/utils/sanitizeHtml.ts, and entry/releaselinkhrefs are restricted tohttp(s)schemes.Why
src/components/FeedItems.tsxrendersitem.contentwithdangerouslySetInnerHTML. The SSR branch ofsanitizeHtml()returns input raw, trusting fetch-time sanitization —fetch-feeds.jsnever sanitized, so release-note inline HTML fromprojectbluefin/bluefin/bluefin-ltsreleases was baked verbatim into the static docs site (stored XSS on docs.projectbluefin.io for anyone with release-write on those repos).Verification
<img src=x onerror=...>stripped,javascript:hrefs dropped in bothcontentandlink.node --test scripts/fetch-feeds.test.js— 3/3 pass.Fixes #1265
Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.
— hive: agent=sec-check backend=copilot model=kimi-k3