← graph

fix-xss-in

Fix XSS in wg html description_html (markdown rendering)

Metadata

Statusdone
Assignedagent-1491
Agent identityf51439356729d112a6c404803d88015d5b44832c6c584c62b96732b63c2b0c7e
Created2026-05-02T02:34:35.806526207+00:00
Started2026-05-02T02:39:22.690239845+00:00
Completed2026-05-02T03:02:46.158986557+00:00
Tagsbug, wg-html, xss, security, eval-scheduled
Eval score0.90
└ blocking impact0.90
└ completeness0.94
└ coordination overhead0.92
└ correctness0.94
└ downstream usability0.88
└ efficiency0.88
└ intent fidelity0.94
└ style adherence0.92

Description

Description

The integration test tests/integration_html.rs::description_html_is_escaped fails on main: the new <div id="desc-pretty" class="description-rendered"> block (added by polish-wg-html) renders the task description through pulldown-cmark and writes the result raw — letting <script>alert('pwn')</script> through. The companion <pre id="desc-raw"> correctly escapes, but the "pretty" view does not.

Reproduction:

cargo test --release --test integration_html description_html_is_escaped

Likely fix: post-process pulldown-cmark output through an HTML sanitizer (e.g. ammonia crate) that strips <script> and dangerous attributes before injecting into the page. Apply on the per-task page render path and any other place description_html is emitted.

Found while working on fix-android-firefox-wg-html-font-fallback.

Validation

  • cargo test --release --test integration_html description_html_is_escaped passes
  • No regressions in cargo test --release --test integration_html
  • Sanitizer also blocks , <object>, javascript: URLs in href attrs, and onclick/onload event handlers</li> <li><input disabled="" type="checkbox"/> Add at least one test for each new sanitizer rule</li> </ul>

Depends on

Required by

Log