mirror of https://github.com/garrytan/gstack.git
3095f39ef5
SVG files can contain inline <script> tags, event handlers (onload, onclick), and <foreignObject> elements. When loaded via setContent(), JavaScript executes in an about:blank context with full fetch() access to localhost — including the gstack server itself. Attack vector: a malicious SVG placed in a project directory (via git clone, npm package, or download) gets loaded by the AI agent through load-html. The SVG's JavaScript modifies the DOM to inject prompt injection payloads that the agent reads on subsequent text/snapshot commands. SVG rendering is still available via `goto file://path/to/file.svg` which goes through validateNavigationUrl + validateReadPath with safe-dirs enforcement. |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||