From 36c608eb6ed55eb943196f51cc006ab55d566933 Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Fri, 14 Aug 2026 19:41:54 -0700
Subject: [PATCH] security(browse): drop .svg from the load-html extension
 allowlist

SVG is a script-capable format (inline <script>, event handlers, foreign
objects), so allowing it through load-html's HTML allowlist let a local
.svg execute script in the browse session context. The allowlist is now
.html/.htm/.xhtml only; regression test asserts .svg is rejected.

Contributed by @garagon (PR #1153).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 browse/src/write-commands.ts |  4 ++--
 browse/test/commands.test.ts | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/browse/src/write-commands.ts b/browse/src/write-commands.ts
index 2155e6f23..50efb7ac8 100644
--- a/browse/src/write-commands.ts
+++ b/browse/src/write-commands.ts
@@ -249,11 +249,11 @@ export async function handleWriteCommand(
       if (!filePath) throw new Error('Usage: browse load-html <file> [--wait-until load|domcontentloaded|networkidle] [--tab-id <N>]  |  load-html --from-file <payload.json> [--tab-id <N>]');
 
       // Extension allowlist
-      const ALLOWED_EXT = ['.html', '.htm', '.xhtml', '.svg'];
+      const ALLOWED_EXT = ['.html', '.htm', '.xhtml'];
       const ext = path.extname(filePath).toLowerCase();
       if (!ALLOWED_EXT.includes(ext)) {
         throw new Error(
-          `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml/.svg, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`
+          `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`
         );
       }
 
diff --git a/browse/test/commands.test.ts b/browse/test/commands.test.ts
index b47914dc2..8b33fdb75 100644
--- a/browse/test/commands.test.ts
+++ b/browse/test/commands.test.ts
@@ -2304,6 +2304,19 @@ describe('load-html', () => {
     }
   });
 
+  test('load-html rejects .svg files', async () => {
+    const svgPath = path.join(tmpDir, `load-html-test-${Date.now()}.svg`);
+    fs.writeFileSync(svgPath, '<svg xmlns="http://www.w3.org/2000/svg"><text>hi</text></svg>');
+    try {
+      await handleWriteCommand('load-html', [svgPath], bm);
+      expect(true).toBe(false);
+    } catch (err: any) {
+      expect(err.message).toMatch(/does not appear to be HTML/);
+    } finally {
+      try { fs.unlinkSync(svgPath); } catch {}
+    }
+  });
+
   test('load-html rejects file outside safe dirs', async () => {
     try {
       await handleWriteCommand('load-html', ['/etc/passwd.html'], bm);