From 3095f39ef5f5b4e7873db525a81a82003cb4ea1e Mon Sep 17 00:00:00 2001
From: gus <gustavoraularagon@gmail.com>
Date: Wed, 22 Apr 2026 19:54:42 -0300
Subject: [PATCH] security: remove .svg from load-html extension allowlist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SVG files can contain inline <script> tags, event handlers (onload,
onclick), and <foreignObject> elements. When loaded via setContent(),
JavaScript executes in an about:blank context with full fetch() access
to localhost — including the gstack server itself.

Attack vector: a malicious SVG placed in a project directory (via git
clone, npm package, or download) gets loaded by the AI agent through
load-html. The SVG's JavaScript modifies the DOM to inject prompt
injection payloads that the agent reads on subsequent text/snapshot
commands.

SVG rendering is still available via `goto file://path/to/file.svg`
which goes through validateNavigationUrl + validateReadPath with
safe-dirs enforcement.
---
 browse/src/write-commands.ts |  4 ++--
 browse/test/commands.test.ts | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/browse/src/write-commands.ts b/browse/src/write-commands.ts
index 73896ba39..15ce79616 100644
--- a/browse/src/write-commands.ts
+++ b/browse/src/write-commands.ts
@@ -247,11 +247,11 @@ export async function handleWriteCommand(
       if (!filePath) throw new Error('Usage: browse load-html <file> [--wait-until load|domcontentloaded|networkidle] [--tab-id <N>]  |  load-html --from-file <payload.json> [--tab-id <N>]');
 
       // Extension allowlist
-      const ALLOWED_EXT = ['.html', '.htm', '.xhtml', '.svg'];
+      const ALLOWED_EXT = ['.html', '.htm', '.xhtml'];
       const ext = path.extname(filePath).toLowerCase();
       if (!ALLOWED_EXT.includes(ext)) {
         throw new Error(
-          `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml/.svg, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`
+          `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`
         );
       }
 
diff --git a/browse/test/commands.test.ts b/browse/test/commands.test.ts
index b3870c0cc..5916c35dd 100644
--- a/browse/test/commands.test.ts
+++ b/browse/test/commands.test.ts
@@ -2143,6 +2143,19 @@ describe('load-html', () => {
     }
   });
 
+  test('load-html rejects .svg files', async () => {
+    const svgPath = path.join(tmpDir, `load-html-test-${Date.now()}.svg`);
+    fs.writeFileSync(svgPath, '<svg xmlns="http://www.w3.org/2000/svg"><text>hi</text></svg>');
+    try {
+      await handleWriteCommand('load-html', [svgPath], bm);
+      expect(true).toBe(false);
+    } catch (err: any) {
+      expect(err.message).toMatch(/does not appear to be HTML/);
+    } finally {
+      try { fs.unlinkSync(svgPath); } catch {}
+    }
+  });
+
   test('load-html rejects file outside safe dirs', async () => {
     try {
       await handleWriteCommand('load-html', ['/etc/passwd.html'], bm);