Scanner hardening strategy: move SVG/MDX active-content scanning off per-bypass regex patching
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Refactor
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript
- Domain
- security
Research direction
Start by reading scripts/lib/svg-active-content.mjs and scripts/lib/architecture-content.mjs, then run tests/svg-active-content.test.mjs to understand the historical bypass fixtures. The issue asks for a discussion or ADR to choose parser-based scanning, sanitization, or both; implementation scope depends on that decision. Done means the chosen approach passes the full fixture corpus and residual risks are documented alongside the rules from #1096.
Written by the indexing model from the issue text.
Description
Problem: the bypass class keeps recurring; per-bypass patching is losing
The import-pipeline content scanner (scripts/lib/svg-active-content.mjs, scripts/lib/architecture-content.mjs) accumulated roughly ten distinct bypass classes in one week of sec-check findings, each fixed by another regex:
- #1005 internal DTD entities; #1023 DOCTYPE external identifiers containing '['
- #1038 / #1121 MDX hidden by multi-line or block-crossing code spans
- #1043 CDATA-hidden
</style>; #1089 CSS escapes; #1091 CSS comments - #1067 backslash authority prefixes; #1175
image-set()bare strings - #1167
data:markup media types; #1180 protocol-relative image hosts
svg-active-content.mjs currently performs its analysis through 13 regex operations over text that is actually XML + CSS. Each finding above is the same root cause: regexes approximate grammars that have escaping, comments, and tokenizer states the regex cannot see. The historical rate (~10/week) predicts the next bypass; the per-bypass loop produces unbounded future work and a permanently uncertain gate.
Proposed direction (pick via discussion)
- Parse, do not pattern-match. Run SVG through a real XML parser (e.g.
@rgrove/parse-xmlorsax) and walk the element/attribute tree; tokenize embedded CSS with a real CSS tokenizer before looking for remote targets. Grammar-level analysis eliminates the escaping/comment/CDATA class wholesale. - Sanitize instead of scan-and-reject for the mirror path: project the SVG onto an element/attribute allowlist (DOMPurify-style, or rebuild from the parsed tree), so unknown constructs are dropped rather than needing to be anticipated.
- Defense in depth at serve time: the CSP currently ships only as a
<meta http-equiv>tag (docusaurus.config.js:148), which cannot cover everything response headers can on GitHub Pages — document this residual risk and the compensating controls in the content-security doc requested by #1096.
Keep the existing regression test corpus (tests/svg-active-content.test.mjs) as the acceptance suite: every past bypass becomes a fixture the parser-based gate must still reject.
Completion criteria
- A decision (ADR or issue consensus) on parser-based scanning vs sanitization vs both.
- The chosen implementation passes the full historical-bypass fixture corpus.
- Residual risks documented alongside the submitter-facing rules from #1096.
Refs #1096 (documentation counterpart).
- Dominant language
- JavaScript
- Stars
- 0
- Forks
- 2
- Avg merge
- 21h 59m
- Merged PRs (30d)
- 431
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cncf/endusers
-
agent/scanner hive/hosted-available-lke648397-260827-5n31 quality testing
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
agent/quality hive/hosted-available-lke648397-260827-5n31 quality testing
Difficulty 4/5 3-5 days Newbie friendliness 42/100
Maintainers usually reply within 1 day
-
quality testing
Difficulty 4/5 3-5 days Newbie friendliness 52/100
cncf/endusers#1187 · 1 comment ·
Maintainers usually reply within 1 day
-
agent/quality hive/hosted-available-lke648397-260827-5n31 hive/verified-open needs-human quality testing
Difficulty 4/5 3-5 days Newbie friendliness 35/100
cncf/endusers#1079 · 13 comments ·
Maintainers usually reply within 1 day
-
[strategist] Define the path from personal repo to CNCF ownership (endusers.cncf.io cutover)May be free again A pull request for this issue was closed without being merged. Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
cncf/endusers#46 · 4 comments ·
Maintainers usually reply within 1 day
Similar issues
-
component:sight
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
agentic-os-org/ANOLISA#6738 · 2 comments ·
Maintainers usually reply within 1 day
-
bug Durable Agents Observability (AI Telemetry) status: needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
mastra-ai/mastra#26470 · 1 comment ·
Maintainers usually reply within 1 day
-
feature/cohorts feature/feature-flags team/feature-flags
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Orbit-xyz/orbit-docs#11 ·
-
area/build area/tech debt
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 2 days