RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(make-pdf): SVG remote refs and image-set can no longer fetch offline 

<svg><image href=https://…> and <use xlink:href=…> survived the gate (only
javascript: schemes were stripped from svg hrefs), and bare-string
image-set("https://…" 1x) dodged the url()-shaped neutralizer. Remote
svg hrefs rewrite to '#' (entity-decode-aware, unclosed-svg smuggle
closed) and remote image-set args neutralize to url(#). Local fragments,
local image-set, and plain <a> links pinned intact. 12 new rows, red-first.
This commit is contained in:
Garry Tan 2026-08-14 21:04:18 -07:00
parent a64106535b
commit 8049d0b4ac
No known key found for this signature in database
GPG Key ID: C1F69E85C74EFE1D
2 changed files with 113 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
make-pdf/src/render.ts
View File

@ -206,6 +206,10 @@ function decodeTypographicEntities(html: string): string {
* - on* event handler attributes (onclick, ONCLICK, etc.).
* - href/src with javascript: scheme.
* - <svg> tags with <script> inside them.
* - remote href/xlink:href inside <svg> (and on svg-only elements anywhere)
* → "#" (offline posture: no fetch at print time).
* - remote CSS fetch vectors in <style> blocks and style attributes
* (@import, url(), image-set() with remote string candidates).
*/
export function sanitizeUntrustedHtml(html: string): string {
let s = html;
@ -284,6 +288,13 @@ export function sanitizeUntrustedHtml(html: string): string {
out = out.replace(
/url\(\s*(?:&quot;|&#0?39;|&#x27;|["'])?\s*(?:https?:)?\/\/[^)]*(?:\)|$)/gi,
"url(#)");
// (e) image-set() / -webkit-image-set() accept BARE quoted URL strings —
// no url() token, no backslash — so passes (c)/(d) never fire on
// `image-set("https://…" 1x)`. Any image-set whose arguments carry a
// remote-scheme quoted string → url(#) (fail closed). Local string
// candidates stay; url()-form arguments are already covered by (c)/(d).
out = out.replace(/(?:-webkit-)?image-set\(\s*[^)]*(?:\)|$)/gi, (m) =>
/(?:&quot;|&#0?39;|&#x27;|["'])\s*(?:https?:)?\/\//i.test(m) ? "url(#)" : m);
return out;
};
@ -334,6 +345,31 @@ export function sanitizeUntrustedHtml(html: string): string {
return `${pre}"${escapeHtml(cleaned)}"`;
});
// SVG remote-fetch vectors: <image href>, <use href>, <feImage href> (and
// their xlink:href spellings) fetch at print time — the svg handling above
// only strips <script>, and the javascript:-scheme rewrite doesn't touch a
// plain https:// href. Fail closed: inside an <svg> block, ANY href /
// xlink:href whose entity-decoded value is remote (https?:// or //) is
// rewritten to "#"; local fragment refs (href="#id") and local files stay
// intact. The tag-scoped second pass catches svg-only elements smuggled
// through an UNCLOSED <svg> (Chromium auto-closes at EOF and still
// fetches); outside foreign content those tags are inert or parser-mapped
// to <img> (href ignored), so the extra pass can't break plain HTML —
// regular <a href> hyperlinks are untouched (links don't fetch at print).
const neutralizeRemoteSvgHref = (fragment: string): string =>
fragment.replace(
/(\s(?:xlink:)?href\s*=\s*)("([^"]*)"|'([^']*)'|[^\s>]+)/gi,
(m, pre, val, dq, sq) => {
// Decode the value the way the HTML parser will (same single-round
// decode as style attributes above), then drop the tab/newline/CR
// characters URL parsing ignores, so &#104;ttps and h\nttps count.
const raw = dq ?? sq ?? String(val);
const decoded = decodeStyleAttrEntities(raw).replace(/[\t\n\r]/g, "");
return /^\s*(?:https?:)?\/\//i.test(decoded) ? `${pre}"#"` : m;
});
s = s.replace(/<svg\b[\s\S]*?<\/svg>/gi, neutralizeRemoteSvgHref);
s = s.replace(/<(?:image|use|feimage)\b[^>]*>/gi, neutralizeRemoteSvgHref);
// srcset with a remote candidate: Chromium prefers srcset over the inlined
// src, so a remote candidate fetches at print time. Strip the attribute;
// local/data: srcset values are left alone.

77
make-pdf/test/render-offline-sanitize.test.ts
View File

@ -149,6 +149,81 @@ describe("sanitizeUntrustedHtml (offline fetch vectors)", () => {
expect(sanitizeUntrustedHtml(input)).toContain(`srcset="a.png 1x, a@2x.png 2x"`);
});
// ── Bypass regressions: SVG remote-fetch vectors ──
// The svg handling only stripped <script> and the javascript: scheme, so a
// plain https:// href on <image>/<use>/<feImage> survived and Chromium
// fetched it at print time.
test("neutralizes remote <image href> inside <svg> blocks", () => {
const out = sanitizeUntrustedHtml(`<svg><image href="https://evil.example/x.png"/></svg>`);
expect(out).not.toContain("evil.example");
expect(out).toContain(`href="#"`);
});
test("neutralizes remote <use xlink:href> inside <svg> blocks", () => {
const out = sanitizeUntrustedHtml(`<svg><use xlink:href="https://evil.example/defs.svg#icon"/></svg>`);
expect(out).not.toContain("evil.example");
});
test("neutralizes protocol-relative and unquoted svg hrefs", () => {
const out = sanitizeUntrustedHtml(`<svg><image href=//evil.example/x.png /><use href='//evil.example/d.svg#i'/></svg>`);
expect(out).not.toContain("evil.example");
});
test("neutralizes remote svg-element href even when the <svg> is never closed", () => {
// Chromium auto-closes an unclosed <svg> at EOF and still fetches.
const out = sanitizeUntrustedHtml(`<svg><image href="https://evil.example/x.png">`);
expect(out).not.toContain("evil.example");
});
test("neutralizes entity-obfuscated remote svg href (&#104;ttps)", () => {
const out = sanitizeUntrustedHtml(`<svg><image href="&#104;ttps://evil.example/x.png"/></svg>`);
expect(out).not.toContain("evil.example");
});
test("keeps local fragment href (#id) inside svg intact", () => {
const input = `<svg><defs><circle id="dot" r="2"/></defs><use href="#dot"/><use xlink:href="#dot"/></svg>`;
const out = sanitizeUntrustedHtml(input);
expect(out).toContain(`href="#dot"`);
expect(out).toContain(`xlink:href="#dot"`);
});
test("keeps local-file svg <image href> intact", () => {
expect(sanitizeUntrustedHtml(`<svg><image href="local.png"/></svg>`)).toContain(`href="local.png"`);
});
test("leaves regular <a href=\"https://…\"> hyperlinks alone (links don't fetch at print)", () => {
const input = `<a href="https://example.com/docs">docs</a>`;
expect(sanitizeUntrustedHtml(input)).toContain(`href="https://example.com/docs"`);
});
// ── Bypass regressions: image-set() with bare quoted URL strings ──
// `image-set("https://…" 1x)` carries no url() token and no backslash, so
// the url()/escape passes never fired on it.
test("neutralizes remote image-set(...) in <style> blocks", () => {
const input = `<style>body { background: image-set("https://evil.example/a.png" 1x); color: blue; }</style>`;
const out = sanitizeUntrustedHtml(input);
expect(out).not.toContain("evil.example");
expect(out).toContain("url(#)");
expect(out).toContain("color: blue");
});
test("neutralizes remote image-set(...) in style attributes", () => {
const out = sanitizeUntrustedHtml(`<div style="background: image-set('https://evil.example/a.png' 1x)">x</div>`);
expect(out).not.toContain("evil.example");
});
test("neutralizes -webkit-image-set with a remote string argument", () => {
const out = sanitizeUntrustedHtml(`<style>body{background:-webkit-image-set("//evil.example/a.png" 1x)}</style>`);
expect(out).not.toContain("evil.example");
});
test("keeps local image-set(...) functional", () => {
const input = `<style>body { background: image-set("local.png" 1x, "local@2x.png" 2x); }</style>`;
expect(sanitizeUntrustedHtml(input)).toContain(`image-set("local.png" 1x, "local@2x.png" 2x)`);
});
test("neutralizes remote <video poster> and <source src>", () => {
const input = `<video poster="https://evil.example/p.jpg"><source src="https://evil.example/v.mp4"></video>`;
const out = sanitizeUntrustedHtml(input);
@ -173,6 +248,8 @@ describe("sanitizeUntrustedHtml (offline fetch vectors)", () => {
`<style>@import url("https://evil.example/t.css"); h1{color:red}</style>`,
`<div style="background:url('https://evil.example/px.gif')">hi</div>`,
`<img src="a.png" srcset="https://evil.example/a.png 2x">`,
`<svg><image href="https://evil.example/s.png"/><use xlink:href="https://evil.example/d.svg#i"/></svg>`,
`<div style="background:image-set('https://evil.example/is.png' 1x)">x</div>`,
].join("\n\n");
const { bodyHtml } = render({ markdown: md });
expect(bodyHtml).not.toContain("evil.example");