Fix/doc site mermaid - #109
Merged
Merged
Conversation
fredbi
force-pushed
the
fix/doc-site-mermaid
branch
from
August 14, 2026 15:42
96fb5dd to
4a0bfa5
Compare
The rendered diagram is assigned with innerHTML, and Mermaid was initialized with securityLevel 'loose' — which is precisely the setting that turns off the sanitizer Mermaid otherwise runs over the SVG it hands back, and allows HTML labels and click bindings in the diagram source. A grammar production is repo-authored, so nothing here was reachable from outside, but the diagrams carry no HTML labels and render identically under 'strict': the same seven diagrams on the grammar page come back byte for byte unchanged. The two error paths built their markup by concatenating a renderer message into innerHTML. That message is the one string on this path we do not author; it now goes through textContent, and the sink is gone with it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
11.16.0 is subject to five published advisories, all fixed in this patch release: prototype pollution through the configuration APIs (GHSA-c4c3-pg64-4m4v) and through architecture diagrams (GHSA-3rrr-jr9j-h3q3), CSS injection reaching elements beside the diagram (GHSA-6x64-9x62-f2gx), and two denial-of-service loops in the xychart and radar renderers (GHSA-2v8p-3f2j-5mp7, GHSA-rhh3-jpg6-66xh). Mermaid is vendored for the railroad shortcode and served from our own static tree, so it is javascript we ship. The railroad diagrams render unchanged on the patch release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
The Relearn theme and Mermaid are fetched at build time and end up as javascript served to every visitor of the site, and both were taken on trust. They are now fetched with -f, over https with no downgrade, and checked against a recorded sha256 before anything is unpacked. The missing -f was a bug on its own: curl wrote the body of an HTTP error response to mermaid.min.js and the build carried on, publishing a page whose diagrams could never render. A failing check is not necessarily an attack — the version and its digest move together, and the command to recompute one is in the step. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
The line was written with innerHTML around values the worker sends back — an exit code and the definition names read out of the scanned module. Neither is markup, and neither is ours: the probe scans whatever module it is pointed at. It is assembled with createElement and textContent now, so there is no HTML parser on that path at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
fredbi
force-pushed
the
fix/doc-site-mermaid
branch
from
August 14, 2026 16:37
4a0bfa5 to
91d6f4d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change type
Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update
Short description
Fixes
Full description
Checklist