ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-03 04:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allowlist html-attribute names to prevent stored XSS surface

Browse Source
This commit is contained in:
Miguel Ángel
2026-05-20 17:17:46 -04:00
parent a58a881d2e
commit addc6ec9cd
2 changed files with 86 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/studio-api/helpers/sourceMutation.test.ts
+37
View File
@@ -146,4 +146,41 @@ describe("patchElementInHtml", () => {
expect(result).toMatch(/padding:\s*16px/);
});
it("rejects event handler attributes", () => {
const result = patchElementInHtml(FIXTURE, { id: "hero" }, [
{ type: "html-attribute", property: "onload", value: "fetch('/evil')" },
]);
expect(result).not.toContain("onload");
expect(result).not.toContain("fetch");
});
it("rejects javascript: URLs in src", () => {
const result = patchElementInHtml(FIXTURE, { id: "hero" }, [
{ type: "html-attribute", property: "src", value: "javascript:alert(1)" },
]);
expect(result).not.toContain("javascript:");
});
it("allows aria-* and data-* attributes", () => {
const result = patchElementInHtml(FIXTURE, { id: "hero" }, [
{ type: "html-attribute", property: "aria-label", value: "greeting" },
{ type: "html-attribute", property: "data-custom", value: "test" },
]);
expect(result).toContain('aria-label="greeting"');
expect(result).toContain('data-custom="test"');
});
it("rejects srcdoc and formaction attributes", () => {
const result = patchElementInHtml(FIXTURE, { id: "hero" }, [
{ type: "html-attribute", property: "srcdoc", value: "<script>alert(1)</script>" },
{ type: "html-attribute", property: "formaction", value: "javascript:void(0)" },
]);
expect(result).not.toContain("srcdoc");
expect(result).not.toContain("formaction");
});
});