Repository navigation
fix: strip object/embed tags in sanitizeHtmlForMdx - #7530
Conversation
These tags were not covered by the existing <script>/<style>/<iframe> stripping, allowing e.g. <object data="javascript:..."> or <embed src="data:text/html,..."> to survive sanitization and execute same-origin in rendered MDX content. Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
kubestellar-prow
Bot
added
the
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
✅ Deploy Preview for kubestellar-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
kubestellar-prow
Bot
added
needs-ok-to-test
|
Hi @hivecommons-hive[bot]. Thanks for your PR. I'm waiting for a kubestellar member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
hivecommons-hive
Bot
added
author/hive
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Read the sanitizer at merge base and the full diff. Verified at base src/lib/sanitizeHtml.ts that <object>/<embed> were indeed never stripped anywhere (only script/style/iframe, meta/link/base), so the gap in #7529 is real. The fix mirrors the existing iframe idiom exactly: early-pass stripUntilStable pair+lone-opener removal (src/lib/sanitizeHtml.ts:251-258) plus the same patterns inside the stripDangerousPatterns stability loop (src/lib/sanitizeHtml.ts:156-163), so spacer reconstruction (e.g. <obj<script>…</script>ect>) is caught on the next outer iteration. Tests fail without the fix and cover both paired and self-closing forms.
One parity note (info, not a defect): like <iframe>, a truncated opener with no closing > at end-of-input (e.g. <object data="javascript:… at EOF) is not removed — only script/style get the pass-3 partial-opener treatment via stripTagUntilClean. An unterminated tag doesn't render, and the fuzz gate passed, so this is fine as-is; worth folding iframe/object/embed into stripTagUntilClean someday for uniformity.
Looks correct to me. CI (unit, fuzz, CodeQL) is green; a maintainer can take it from here.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
|
Thank you for your contribution! Your PR has been merged. Check out what's new:
Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey |
hivecommons-hive
Bot
removed
role/trusted
Security Fix
sanitizeHtmlForMdx(the primary XSS defense for user-supplied MDX content) stripped<script>,<style>, and<iframe>tags but left<object>and<embed>tags completely untouched, including dangerousjavascript:/data:URIs in theirdata=/src=attributes. This change strips both tags using the same open/close pair + lone-opener pattern already used for<iframe>, in both the early removal pass and thestripDangerousPatternsstability loop (for spacer-attack resistance), plus unit tests that fail without the fix.Fixes #7529
Filed by sec-check agent (ACMM L6 — full mode)
— hive: agent=sec-check backend=copilot model=claude-opus-4.7 copilot=1.0.88