fix(security): harden XSS, canvas errors, and Wasm input limits - #18
Open
sousuke0422 wants to merge 5 commits into
Open
fix(security): harden XSS, canvas errors, and Wasm input limits#18sousuke0422 wants to merge 5 commits into
sousuke0422 wants to merge 5 commits into
Conversation
Escape quotes in SVG attributes, return safe empty SVG on parse failure, serialize canvas errors with serde_json, clear canvas on failure paths, pin chromaui/action to a fixed SHA, and cap Wasm task/dep/date inputs. Assisted-by: Cursor Co-authored-by: Cursor <cursoragent@cursor.com> Assisted-by: multi-agent-shogun-aki-tweak
Action SHA-pinning across all workflows is handled by PR #16 (ci/cache-and-action-bump) to avoid touching the same file in two branches. This security branch keeps only the Rust/Vue code hardening. Assisted-by: multi-agent-shogun-aki-tweak
|
Tip All tests passed and all changes approved!🟢 UI Tests: 5 tests unchanged |
Derive canvas row and date-span limits from the conservative 16384px backing-store edge, while preserving the wider SVG date limit. Reset both bitmap and CSS dimensions after empty or error output. Assisted-by: multi-agent-shogun-aki-tweak
Assisted-by: multi-agent-shogun-aki-tweak
…lization Assisted-by: multi-agent-shogun-aki-tweak
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
リポジトリ初回監査で判明した 🚨 High（XSS×2）＋クラッシュ/誤動作の Medium を修正する。生成物が
v-htmlsink（arc-vueGanttChart.vue）へ渡るため、悪意入力・極端入力が届く経路を断つのが主眼。CI 側の Action SHA 固定は本 PR では扱わない（PR #16 で全 workflow を一括固定）。
修正内容（各々に回帰テスト付き）
backend/svg.rs:escape_xmlを属性安全化（"→"/'→'）＋ Wasm 境界で task id を検証。data-task-id="…"から属性を抜け出す注入を防ぐ。render.rs: parse error を<!-- parse error: {e} -->として返す実装を廃し、markup を返さず安全なレスポンスにする。--><img onerror=…>等の HTML 注入を防ぐ。render.rs:render_canvas_commandsのエラー生成を文字列補間からserde_jsonへ。引用符/改行で JSON が壊れない。arc-vue（GanttChart.vue/replayCommands.ts）: 失敗経路で canvas を clear・hit regions をリセット、JSON.parseを保護。前回描画・クリック領域の残留を防ぐ。render.rs: Wasm 入口で件数・日付範囲に実効上限を設け、超過時は安全レスポンス。極端入力での DOM/canvas 爆発を防ぐ。tiling/virtualization の全面再設計は後続。テスト
cargo nextest/wasm-pack test --node緑（悪意 id・注入入力・上限超過の回帰含む）※ DRAFT 解除・merge は maintainer 判断。後続 backlog: arc-vue CSS export / release で arc-vue publish / #11 tiling 再設計。
Assisted-by: multi-agent-shogun-aki-tweak