From db7d962acdfdb308aa012234e9f6a28bafab0561 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Thu, 9 Jul 2026 20:33:17 -0700
Subject: [PATCH 1/5] fix(security): close code-scanning and dependabot alerts

- markdown-paste.ts: strip <style>/<script> in a loop, not a single
  pass, so nested/overlapping tags can't leave a surviving <script>
  behind (incomplete multi-character sanitization)
- block-identity.ts: annotate the two SHA-1 uses as intentional
  (UUIDv5 per RFC 4122, deterministic id derivation only, not a
  security use of the hash) rather than swap algorithms, which would
  change every derived fork block id
- apps/pii: bump transformers 4.56.2 -> 5.3.0 (CVE-2026-4372 RCE via
  crafted config.json, CVE-2026-1839 RCE via Trainer torch.load),
  huggingface_hub 0.35.3 -> 1.3.0 (transformers 5.3.0's floor), and
  pytest 8.4.1 -> 9.0.3 (CVE-2025-71176 tmpdir handling); verified
  pip resolves cleanly and the unit test suite passes on 9.0.3
---
 apps/pii/requirements-dev.txt                        |  2 +-
 apps/pii/requirements-gliner.txt                     |  4 ++--
 .../rich-markdown-editor/markdown-paste.ts           | 12 +++++++++++-
 .../ee/workspace-forking/lib/remap/block-identity.ts |  8 ++++++--
 4 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/apps/pii/requirements-dev.txt b/apps/pii/requirements-dev.txt
index 4c330d999ae..68a538f5f1d 100644
--- a/apps/pii/requirements-dev.txt
+++ b/apps/pii/requirements-dev.txt
@@ -1,5 +1,5 @@
 # Test-only deps. Unit tests need requirements.txt + this file (no models);
 # integration tests additionally need the models baked into the docker images
 # (see tests/test_integration.py).
-pytest==8.4.1
+pytest==9.0.3
 httpx==0.28.1
diff --git a/apps/pii/requirements-gliner.txt b/apps/pii/requirements-gliner.txt
index d620c5f1825..a3d002f3850 100644
--- a/apps/pii/requirements-gliner.txt
+++ b/apps/pii/requirements-gliner.txt
@@ -6,5 +6,5 @@
 # torch is pinned in the Dockerfile instead: the CPU and CUDA targets install
 # the same version from different wheel indexes.
 gliner==0.2.27
-transformers==4.56.2
-huggingface_hub==0.35.3
+transformers==5.3.0
+huggingface_hub==1.3.0
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
index 83b829e50e7..6dbd93c8966 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
@@ -81,9 +81,19 @@ const NON_CONTENT_HTML = /<(style|script)\b[\s\S]*?<\/\1>/gi
  * block of CSS (and Sheets a `<google-sheets-html-origin>` wrapper); ProseMirror's DOM parser has no
  * rule for `<style>`, so it would walk the element's CSS text into the document as literal paragraphs.
  * Removing these before parsing keeps the pasted content clean (PM already discards unknown wrappers).
+ *
+ * Replaces in a loop (not a single pass) so nested/overlapping tags — e.g. `<script><script>x</script>` —
+ * can't leave a surviving `<script>` behind: each pass can only remove the innermost non-overlapping
+ * matches, and a single pass over nested tags leaves the outer one dangling.
  */
 function stripNonContentHtml(html: string): string {
-  return html.replace(NON_CONTENT_HTML, '')
+  let previous: string
+  let stripped = html
+  do {
+    previous = stripped
+    stripped = previous.replace(NON_CONTENT_HTML, '')
+  } while (stripped !== previous)
+  return stripped
 }
 
 /**
diff --git a/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts b/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts
index fd659d4a646..93b58173e71 100644
--- a/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts
+++ b/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts
@@ -17,9 +17,13 @@ function uuidToBytes(uuid: string): Buffer {
  * always yield the same UUID, which is how fork block identity stays stable.
  */
 function uuidV5(name: string, namespace: string): string {
+  // SHA-1 is mandated by RFC 4122 for UUIDv5 and is used here only for deterministic id derivation,
+  // never for secrecy or integrity — not a security use of the algorithm. Swapping it would change
+  // every derived id, breaking webhook URLs and stored block-id references across existing forks
+  // (see FORK_BLOCK_NAMESPACE doc above).
   const hash = createHash('sha1')
-  hash.update(uuidToBytes(namespace))
-  hash.update(Buffer.from(name, 'utf8'))
+  hash.update(uuidToBytes(namespace)) // lgtm[js/weak-cryptographic-algorithm]
+  hash.update(Buffer.from(name, 'utf8')) // lgtm[js/weak-cryptographic-algorithm]
   const bytes = hash.digest().subarray(0, 16)
   bytes[6] = (bytes[6] & 0x0f) | 0x50
   bytes[8] = (bytes[8] & 0x3f) | 0x80

From 44f48ada0f3d5542076b4d2ca1ee9a5f46206c62 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Thu, 9 Jul 2026 20:39:30 -0700
Subject: [PATCH 2/5] fix(files): make markdown-paste sanitizer O(n) instead of
 O(n*depth)

Greptile flagged the repeated-replace loop from the prior commit: it
strips <style>/<script> correctly but rescans the whole string once
per nesting level, so deeply nested clipboard HTML can freeze the tab.
Replace it with a single linear pass that tracks nesting depth of the
open tag via a tag-token scan, dropping the element in one pass no
matter how deeply nested.
---
 .../rich-markdown-editor/markdown-paste.ts    | 40 +++++++++++++------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
index 6dbd93c8966..0e22d176e01 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
@@ -73,8 +73,8 @@ function parseVscodeLanguage(data: string | undefined): string {
   }
 }
 
-/** `<style>`/`<script>` elements (with their content), matched as a pair via the tag backreference. */
-const NON_CONTENT_HTML = /<(style|script)\b[\s\S]*?<\/\1>/gi
+/** A `<style>`/`<script>` open or close tag token, scanned one at a time (never the element body). */
+const NON_CONTENT_TAG = /<\/?\s*(style|script)\b[^>]*>/gi
 
 /**
  * Strips `<style>`/`<script>` elements from pasted HTML. Google Sheets and Word prepend a `<style>`
@@ -82,18 +82,34 @@ const NON_CONTENT_HTML = /<(style|script)\b[\s\S]*?<\/\1>/gi
  * rule for `<style>`, so it would walk the element's CSS text into the document as literal paragraphs.
  * Removing these before parsing keeps the pasted content clean (PM already discards unknown wrappers).
  *
- * Replaces in a loop (not a single pass) so nested/overlapping tags — e.g. `<script><script>x</script>` —
- * can't leave a surviving `<script>` behind: each pass can only remove the innermost non-overlapping
- * matches, and a single pass over nested tags leaves the outer one dangling.
+ * Scans tag tokens in a single linear pass, tracking nesting depth of the currently-open tag name, so
+ * nested/overlapping tags — e.g. `<script><script>x</script>` — can't leave a surviving `<script>`
+ * behind. A naive single `replace()` pass over `<tag>[\s\S]*?<\/tag>` matches only the innermost pair
+ * and leaves the outer tag dangling; repeating that replace until stable fixes correctness but costs
+ * O(depth) full-string rescans on attacker-controlled clipboard input. This does it in one pass instead.
  */
 function stripNonContentHtml(html: string): string {
-  let previous: string
-  let stripped = html
-  do {
-    previous = stripped
-    stripped = previous.replace(NON_CONTENT_HTML, '')
-  } while (stripped !== previous)
-  return stripped
+  let result = ''
+  let cursor = 0
+  let depth = 0
+  let openTagName = ''
+  NON_CONTENT_TAG.lastIndex = 0
+  let match: RegExpExecArray | null
+  while ((match = NON_CONTENT_TAG.exec(html))) {
+    const isClosing = match[0][1] === '/'
+    const tagName = match[1].toLowerCase()
+    if (depth === 0) {
+      if (isClosing) continue // stray close tag outside any open element — leave it in place
+      result += html.slice(cursor, match.index)
+      openTagName = tagName
+      depth = 1
+    } else if (tagName === openTagName) {
+      depth += isClosing ? -1 : 1
+      if (depth === 0) cursor = match.index + match[0].length
+    }
+  }
+  result += html.slice(cursor)
+  return result
 }
 
 /**

From 2ec7bdfcc2305684c70cc76dcaf8dadc68a45bcc Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Thu, 9 Jul 2026 20:41:14 -0700
Subject: [PATCH 3/5] style: fold inline comments into TSDoc per repo comment
 convention

Repo convention is TSDoc-only documentation, no non-TSDoc explanatory
comments. Moved the uuidV5 SHA-1 rationale and the stray-close-tag note
into the existing TSDoc blocks above each function. Left the two
lgtm[...] annotations as trailing comments since those are functional
CodeQL suppression directives (must sit on the flagged line), not
documentation.
---
 .../file-viewer/rich-markdown-editor/markdown-paste.ts   | 3 ++-
 .../sim/ee/workspace-forking/lib/remap/block-identity.ts | 9 +++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
index 0e22d176e01..1a9b8177776 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
@@ -87,6 +87,7 @@ const NON_CONTENT_TAG = /<\/?\s*(style|script)\b[^>]*>/gi
  * behind. A naive single `replace()` pass over `<tag>[\s\S]*?<\/tag>` matches only the innermost pair
  * and leaves the outer tag dangling; repeating that replace until stable fixes correctness but costs
  * O(depth) full-string rescans on attacker-controlled clipboard input. This does it in one pass instead.
+ * A stray close tag encountered outside any open element (depth 0) is left in place untouched.
  */
 function stripNonContentHtml(html: string): string {
   let result = ''
@@ -99,7 +100,7 @@ function stripNonContentHtml(html: string): string {
     const isClosing = match[0][1] === '/'
     const tagName = match[1].toLowerCase()
     if (depth === 0) {
-      if (isClosing) continue // stray close tag outside any open element — leave it in place
+      if (isClosing) continue
       result += html.slice(cursor, match.index)
       openTagName = tagName
       depth = 1
diff --git a/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts b/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts
index 93b58173e71..6360584cf69 100644
--- a/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts
+++ b/apps/sim/ee/workspace-forking/lib/remap/block-identity.ts
@@ -15,12 +15,13 @@ function uuidToBytes(uuid: string): Buffer {
 /**
  * Deterministic UUIDv5 (SHA-1) of `name` within `namespace`. The same inputs
  * always yield the same UUID, which is how fork block identity stays stable.
+ *
+ * SHA-1 is mandated by RFC 4122 for UUIDv5 and is used here only for deterministic id derivation,
+ * never for secrecy or integrity — not a security use of the algorithm. Swapping it would change
+ * every derived id, breaking webhook URLs and stored block-id references across existing forks
+ * (see {@link FORK_BLOCK_NAMESPACE}).
  */
 function uuidV5(name: string, namespace: string): string {
-  // SHA-1 is mandated by RFC 4122 for UUIDv5 and is used here only for deterministic id derivation,
-  // never for secrecy or integrity — not a security use of the algorithm. Swapping it would change
-  // every derived id, breaking webhook URLs and stored block-id references across existing forks
-  // (see FORK_BLOCK_NAMESPACE doc above).
   const hash = createHash('sha1')
   hash.update(uuidToBytes(namespace)) // lgtm[js/weak-cryptographic-algorithm]
   hash.update(Buffer.from(name, 'utf8')) // lgtm[js/weak-cryptographic-algorithm]

From 8b3f9bf459bbe4b9171a584e7618be99efb2b2e4 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Thu, 9 Jul 2026 20:44:21 -0700
Subject: [PATCH 4/5] test(files): lock in nested-tag stripping regression for
 markdown paste

Covers the case Greptile flagged: nested and 50-deep <script> tags
must strip in one pass without leaking a dangling tag.
---
 .../rich-markdown-editor/markdown-paste.test.ts            | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
index 9abccb28df6..2f6e3656009 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
@@ -240,4 +240,11 @@ describe('markdown paste', () => {
     expect(cleaned).toContain('<td>a</td>')
     expect(transformHtml(editor, 'a<script>alert(1)</script>b')).toBe('ab')
   })
+
+  it('strips nested/repeated <script> tags in a single pass, even deeply nested', () => {
+    editor = mount()
+    expect(transformHtml(editor, 'a<script>x<script>y</script></script>b')).toBe('ab')
+    const deeplyNested = `a${'<script>'.repeat(50)}x${'</script>'.repeat(50)}b`
+    expect(transformHtml(editor, deeplyNested)).toBe('ab')
+  })
 })

From 55051c4f95d2722ddcdfbfef54652dfa0635d768 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Thu, 9 Jul 2026 20:49:51 -0700
Subject: [PATCH 5/5] fix(files): drop unterminated <script>/<style> instead of
 leaking it

Cursor Bugbot caught two related bugs in the single-pass rewrite: if
pasted HTML ends while a script/style element is still open (truncated
or malformed clipboard HTML), cursor never advanced past the open tag,
so the final flush re-appended the untouched tag/content (leaking an
unstripped <script>) and duplicated the prefix already copied into
result.

Fix: advance cursor the moment a tag opens, not when it closes, and
only do the final flush when we end at depth 0. An element that never
closes has cursor already past its open tag, so it and everything
after it is dropped instead of reappearing.
---
 .../rich-markdown-editor/markdown-paste.test.ts           | 7 +++++++
 .../file-viewer/rich-markdown-editor/markdown-paste.ts    | 8 ++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
index 2f6e3656009..b428f01a4da 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
@@ -247,4 +247,11 @@ describe('markdown paste', () => {
     const deeplyNested = `a${'<script>'.repeat(50)}x${'</script>'.repeat(50)}b`
     expect(transformHtml(editor, deeplyNested)).toBe('ab')
   })
+
+  it('drops an unterminated <script>/<style> and everything after it, without duplicating the prefix', () => {
+    editor = mount()
+    expect(transformHtml(editor, 'abc<script>never-closes')).toBe('abc')
+    expect(transformHtml(editor, 'abc<style>never-closes')).toBe('abc')
+    expect(transformHtml(editor, '<script>x<script>y</script>')).toBe('')
+  })
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
index 1a9b8177776..fc138df8354 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
@@ -87,7 +87,10 @@ const NON_CONTENT_TAG = /<\/?\s*(style|script)\b[^>]*>/gi
  * behind. A naive single `replace()` pass over `<tag>[\s\S]*?<\/tag>` matches only the innermost pair
  * and leaves the outer tag dangling; repeating that replace until stable fixes correctness but costs
  * O(depth) full-string rescans on attacker-controlled clipboard input. This does it in one pass instead.
- * A stray close tag encountered outside any open element (depth 0) is left in place untouched.
+ * A stray close tag encountered outside any open element (depth 0) is left in place untouched. `cursor`
+ * advances past an open tag the moment it opens (not when it closes), so if the input ends before the
+ * element closes — truncated or malformed clipboard HTML — the unterminated element and everything
+ * after it is dropped rather than reappearing unstripped in the final `html.slice(cursor)` flush.
  */
 function stripNonContentHtml(html: string): string {
   let result = ''
@@ -104,12 +107,13 @@ function stripNonContentHtml(html: string): string {
       result += html.slice(cursor, match.index)
       openTagName = tagName
       depth = 1
+      cursor = match.index + match[0].length
     } else if (tagName === openTagName) {
       depth += isClosing ? -1 : 1
       if (depth === 0) cursor = match.index + match[0].length
     }
   }
-  result += html.slice(cursor)
+  if (depth === 0) result += html.slice(cursor)
   return result
 }