open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

fix(voyage): sanitize bodyHtml via DOMPurify in renderArtifact (1d3591d4)

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-05-10 21:14:50 +02:00
commit c08bde0649
2 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
plugins/voyage/tests/playground/voyage-playground.test.mjs
View file

@ -483,6 +483,22 @@ test('voyage-playground.html renderArtifact strips comments before md.render (v4
assert.ok(stripIdx > 0 && stripIdx < renderIdx, 'stripUnsafeComments must run before md.render');
});
// v4.3 Step 1 — SC24-security defense in depth: renderArtifact bodyHtml is
// sanitized via DOMPurify before DOM injection (finding 1d3591d4).
test('voyage-playground.html renderArtifact sanitizes bodyHtml via DOMPurify (v4.3 Step 1, finding 1d3591d4)', () => {
const text = readFileSync(HTML, 'utf-8');
// The literal DOMPurify.sanitize(bodyHtml expression must be present.
assert.match(text, /DOMPurify\.sanitize\(bodyHtml/, 'DOMPurify.sanitize(bodyHtml call required in renderArtifact');
// USE_PROFILES: { html: true } must appear nearby (within the renderArtifact body)
const bodyStart = text.indexOf('function renderArtifact');
assert.ok(bodyStart > 0, 'renderArtifact() must exist');
const bodyEnd = text.indexOf('\n }', bodyStart);
const body = text.slice(bodyStart, bodyEnd + 1);
assert.match(body, /USE_PROFILES:\s*\{\s*html:\s*true\s*\}/, 'USE_PROFILES html:true profile required inside renderArtifact');
// Return must reference safeBody, not raw bodyHtml
assert.match(body, /return\s+fmHtml\s*\+\s*safeBody/, 'renderArtifact return must use safeBody');
});
// v4.3 Step 26 — path-traversal + symlink/dotfile filter.
test('voyage-playground.html declares isProjectPathSafe filter (v4.3 Step 26)', () => {
const text = readFileSync(HTML, 'utf-8');