Repository navigation
Fix script tag breakout in generated HTML reports - #3
Merged
Merged
Conversation
xavi-999
reviewed
Nov 3, 2026
Contributor
Author
|
Done! I've updated both files to use LF line endings. Thanks for catching that. |
xavi-999
reviewed
Nov 3, 2026
xavi-999
force-pushed
the
mertcano-patch-1
branch
from
November 3, 2026 15:05
55099d3 to
8eeed89
Compare
xavi-999
changed the title
xavi-999
previously approved these changes
Nov 3, 2026
Contributor
Author
|
Since xavi-999 made the last push to this branch, GitHub blocks them from being the sole approver. Could another maintainer please review and approve this PR, and trigger the pending workflow? Thanks! |
### Summary of Changes Resolves **F19 (High)** and **F20 (High)** from the Uphold Workspace Security Audit: - **HTML Breakout / Stored XSS Prevention (F19 & F20):** - Updated `build_perf_map.mjs` and `build_lcp_map.mjs` to escape `</script>` closing tags before injecting JSON payloads into template script elements. - Neutralizes DOM-based script execution vectors originating from untrusted target repository filenames and traced Chrome resource URLs. - Aligns HTML map generation with the defensive escaping already present in `build_run_report.mjs`. ### Verification - `npm test` passes cleanly (6/6 self-tests, 6/6 invariant validations). - End-to-end artifact generation confirms inputs containing `</script>` are serialized as `<\/script>` within HTML `<script>` tags.
Escape every `<` as `<` in all three builders, which also covers the `<!--<script` sequence and run_report's weaker `</script>` regex. Convert build_lcp_map.mjs to LF, add a hostile payload check to check_invariants.mjs and update the CLAUDE.md convention.
xavi-999
force-pushed
the
mertcano-patch-1
branch
from
November 5, 2026 11:35
8eeed89 to
bc4faf7
Compare
xavi-999
approved these changes
Nov 5, 2026
pgom
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
Resolves F19 (High) and F20 (High) from the Uphold Workspace Security Audit:
build_perf_map.mjsandbuild_lcp_map.mjsto escape</script>closing tags before injecting JSON payloads into template script elements.build_run_report.mjs.Verification
npm testpasses cleanly (6/6 self-tests, 6/6 invariant validations).</script>are serialized as<\/script>within HTML<script>tags.