🔒 fix: sanitize HTML artifact content and sandbox iframe to prevent XSS-to-RCE#13529
Merged
🔒 fix: sanitize HTML artifact content and sandbox iframe to prevent XSS-to-RCE#13529
Conversation
…SS-to-RCE - Add sanitizeHTMLContent() using DOMPurify to strip dangerous tags (script, embed, object, etc.) and all on* event handler attributes - Add sandbox="" attribute to HTML artifact iframe to block all script execution and parent frame access - Replace doc.write() with srcDoc for cleaner rendering - Extract shared FORBID_EVENT_HANDLERS list to DRY up SVG and HTML sanitization Ref: GHSA-xq4x-622m-q8fq Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dfb8e5d19
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Member
|
@Innei @ONLY-yours - This is a security fix for XSS-to-RCE in the HTML artifact renderer, with specific implications for Electron's shellCommand API. Please coordinate on review. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## canary #13529 +/- ##
==========================================
- Coverage 66.43% 66.43% -0.01%
==========================================
Files 1977 1977
Lines 163655 163664 +9
Branches 18716 15752 -2964
==========================================
+ Hits 108724 108727 +3
- Misses 54809 54815 +6
Partials 122 122
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
The package name is @lobechat/utils, not @lobehub/utils. This caused a build failure in Electron desktop app. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Merged
arvinxx
added a commit
that referenced
this pull request
Apr 7, 2026
# 🚀 release: 20260407 This release includes **148 commits**. Key updates are below. - **Response API tool execution is more capable and reliable** — Added hosted builtin tools + client-side function tools and improved tool-call streaming/completion behavior. [#13406](#13406) [#13414](#13414) [#13506](#13506) [#13555](#13555) - **Input and composition UX upgraded** — Added AI input auto-completion and multiple chat-input stability fixes. [#13458](#13458) [#13551](#13551) [#13481](#13481) - **Model/provider compatibility improved** — Better Gemini/Google tool schema handling and additional model updates. [#13429](#13429) [#13465](#13465) [#13613](#13613) - **Desktop and CLI reliability improved** — Gateway WebSocket support and desktop runtime upgrades. [#13608](#13608) [#13550](#13550) [#13557](#13557) - **Security hardening continued** — Fixed auth and sanitization risks and upgraded vulnerable dependencies. [#13535](#13535) [#13529](#13529) [#13479](#13479) ### Models & Providers - Added/updated support for `glm-5v-turbo`, GLM-5.1 updates, and qwen3.5-omni series. [#13487](#13487) [#13405](#13405) [#13422](#13422) - Added additional ImageGen providers/models (Wanxiang 2.7 and Keling from Qwen). [#13478](#13478) - Improved Gemini/Google tool schema and compatibility handling across runtime paths. [#13429](#13429) [#13465](#13465) [#13613](#13613) ### Response API & Runtime - Added hosted builtin tools in Response API and client-side function tool execution support. [#13406](#13406) [#13414](#13414) - Improved stream tool-call argument handling and `response.completed` output correctness. [#13506](#13506) [#13555](#13555) - Improved runtime error/context handling for intervention and provider edge cases. [#13420](#13420) [#13607](#13607) ### Desktop App - Bumped desktop dependencies and runtime integrations (`agent-browser`, `electron`). [#13550](#13550) [#13557](#13557) - Simplified desktop release channel setup by removing nightly release flow. [#13480](#13480) ### CLI - Added OpenClaw migration command. [#13566](#13566) - Added local device binding support for `lh agent run`. [#13277](#13277) - Added WebSocket gateway support and reconnect reliability improvements. [#13608](#13608) [#13418](#13418) ### Security - Removed risky `apiKey` fallback behavior in webapi auth path to prevent bypass risk. [#13535](#13535) - Sanitized HTML artifact rendering and iframe sandboxing to reduce XSS-to-RCE risk. [#13529](#13529) - Upgraded nodemailer to v8 to address SMTP command injection advisory. [#13479](#13479) ### Bug Fixes - Fixed image generation model default switch issues. [#13587](#13587) - Fixed subtopic re-fork message scope behavior and agent panel reset edge cases. [#13606](#13606) [#13556](#13556) - Fixed chat-input freeze on paste and mention plugin behavior. [#13551](#13551) [#13415](#13415) - Fixed auth/social sign-in and settings UX edge cases. [#13368](#13368) [#13392](#13392) [#13338](#13338) ### Credits Huge thanks to these contributors: @chriszf @hardy-one @Innei @lijian @neko @OctopusNote @rdmclin2 @rivertwilight @RylanCai @suyua9 @sxjeru @Tsuki @wangyk @WindSpiritSR @yizhuo @YuTengjing @hezhijie0327 @arvinxx
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sanitizeHTMLContent()using DOMPurify to strip dangerous tags (script,embed,object,link,meta) and allon*event handler attributes from HTML artifact contentsandbox=""attribute to the HTML artifact iframe, blocking all script execution andwindow.parentaccessdoc.write()withsrcDocfor cleaner, safer renderingFORBID_EVENT_HANDLERSlist to DRY up SVG and HTML sanitizationSecurity
Fixes GHSA-xq4x-622m-q8fq — a critical XSS-to-RCE vulnerability where a malicious LLM provider can inject
<img src=x onerror='...'>inside<lobeArtifact>tags, executing arbitrary commands via Electron'sshellCommandAPI.Defense-in-depth approach:
sandbox=""prevents all script execution and parent frame accessTest plan
sanitize.test.tstests pass (6/6)<lobeArtifact type="text/html">still renders safe HTML correctly<img src=x onerror='alert(1)'>inside artifact is stripped and does not executeFORBID_EVENT_HANDLERSrefactor)🤖 Generated with Claude Code