Kanban dashboard XSS via unsanitized markdown HTML

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #50392 fix(security): sanitize Kanban dashboard markdown HTML at the render sink

  merged to main

  files: plugins/kanban/dashboard/dist/index.js, tests/plugins/test_kanban_dashboard_plugin.py

  Show the diff

  • plugins/kanban/dashboard/dist/index.js

    @@ -334,6 +334,48 @@
         );
         return html;
       }
    +  const MARKDOWN_ALLOWED_TAGS = new Set([
    +    "a",
    +    "code",
    +    "em",
    +    "h1",
    +    "h2",
    +    "h3",
    +    "h4",
    +    "li",
    +    "p",
    +    "pre",
    +    "strong",
    +    "ul",
    +  ]);
    +  function escapeAttribute(value) {
    +    return escapeHtml(value).replace(/`/g, "`");
    +  }
    +  function sanitizeMarkdownAttrs(tag, attrs) {
    +    if (tag === "a") {
    +      const hrefMatch =
    +        /\shref=(["'])(.*?)\1/i.exec(attrs) ||
    +        /\shref=([^\s>]+)/i.exec(attrs);
    +      const href = hrefMatch ? (hrefMatch[2] || hrefMatch[1] || "").trim() : "";
    +      if (!/^(https?:\/\/|mailto:)/i.test(href)) return "";
    +      return ` href="${escapeAttribute(href)}" target="_blank" rel="noopener noreferrer"`;
    +    }
    +    if (tag === "pre" && /\sclass=(["'])hermes-kanban-md-code\1/i.test(attrs)) {
    +      return ' class="hermes-kanban-md-code"';
    +    }
    +    return "";
    +  }
    +  function sanitizeMarkdownHtml(html) {
    +    return String(html || "").replace(
    +      /<\/?([a-zA-Z][A-Za-z0-9-]*)([^>]*)>/g,
    +      (match, rawTag, attrs) => {
    +        const tag = rawTag.toLowerCase();
    +        if (!MARKDOWN_ALLOWED_TAGS.has(tag)) return "";
    +        if (/^<\s*\//.test(match)) return `</${tag}>`;
    +        return `<${tag}${sanitizeMarkdownAttrs(tag, attrs || "")}>`;
    +      },
    +    );
    +  }
     
       function MarkdownBlock(props) {
         const enabled = props.enabled !== false;
    @@ -342,7 +384,7 @@
         }
         return h("div", {
           className: "hermes-kanban-md",
    -      dangerouslySetInnerHTML: { __html: renderMarkdown(props.source || "") },
    +      dangerouslySetInnerHTML: { __html: sanitizeMarkdownHtml(renderMarkdown(props.source || "")) },
         });
       }
     

  • tests/plugins/test_kanban_dashboard_plugin.py

    @@ -247,6 +247,19 @@ def test_dashboard_initial_board_uses_backend_current_when_unpinned():
         assert 'readSelectedBoard() || "default"' not in js
     
     
    +def test_dashboard_markdown_html_is_sanitized_before_render():
    +    """Markdown rendering must sanitize HTML before dangerouslySetInnerHTML."""
    +
    +    repo_root = Path(__file__).resolve().parents[2]
    +    bundle = repo_root / "plugins" / "kanban" / "dashboard" / "dist" / "index.js"
    +    js = bundle.read_text()
    +
    +    assert "function sanitizeMarkdownHtml(html)" in js
    +    assert "MARKDOWN_ALLOWED_TAGS" in js
    +    assert "sanitizeMarkdownHtml(renderMarkdown(props.source || \"\"))" in js
    +    assert "dangerouslySetInnerHTML: { __html: renderMarkdown(props.source || \"\") }" not in js
    +
    +
     # ---------------------------------------------------------------------------
     # GET /tasks/:id returns body + comments + events + links
     # ---------------------------------------------------------------------------