Repository navigation
fix(security): parser-based SVG/MDX scanning, replacing per-bypass regex patches - #1245
Merged
mrbobbytables merged 2 commits intoOct 9, 2026
Merged
Conversation
…matching them Replace the regex-based active-content scanners with parser-based ones, per the decision recorded on cncf#1194: - SVG: scan a strict XML parse (sax) and tokenize CSS with css-tree, so escapes, comments, quote pairing and character references are resolved the way a browser resolves them. A document the parser rejects is a finding. Stripping rebuilds the document from the parse rather than splicing text. - MDX: scan the mdast produced by the grammar Docusaurus compiles with. - cleanMarkdown: find images in the CommonMark tree, so reference-style images follow the same remote-image policy as inline ones. - Share URI scheme rules between the scanners in scripts/lib/uri-safety.mjs. - Document the approach and residual risks in CONTENT-SECURITY.md. Closes cncf#1194 Closes cncf#1205 Closes cncf#1212 Closes cncf#1218 Closes cncf#1223 Closes cncf#1228 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
This was referenced Oct 9, 2026
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged the prolog pattern as exponential on repeated '<?' and '<!--' units. Walk the prolog linearly instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the decision on #1194 (option 1: parse, do not pattern-match).
What changes
scripts/lib/svg-active-content.mjs): scans a strict XML parse (sax); CSS is tokenized withcss-tree. Escapes, comments, quote pairing, and XML character references are resolved before inspection.srcset,poster, andbackgroundare covered.stripActiveContentrebuilds from the parse instead of splicing text.scripts/lib/mdx-active-content.mjs): scans the mdast from the same grammar Docusaurus compiles with. Shares URI scheme rules with the SVG scanner (scripts/lib/uri-safety.mjs).CONTENT-SECURITY.mdexplains the approach, residual risks, and the meta-only CSP.Behaviour change to note
Malformed XML (unquoted attributes, unclosed tags, undefined entities such as
, unterminated DOCTYPE) is now rejected asis not well-formed XMLrather than leniently read. Every historical bypass fixture is kept and still rejected; tests that asserted regex-era behaviour on malformed input now assert rejection. All SVGs understatic/still pass.Validation
npm run test:unit:coverage:check,validate:architecture-assets,validate:architectures, and prettier all pass.Closes #1194
Closes #1205
Closes #1212
Closes #1218
Closes #1223
Closes #1228
Supersedes #1206, #1213, #1219, #1229. #1235 (meta CSP script/style-src) and #1242 (symlinked directory gate) are orthogonal and left open.