render-conformance.mjs

Functions

Imports

It imports render-error.mjs, render-safe.mjs. No module of this repo imports it.

Source

1// The conformance corpus for the markdown pipeline: hostile inputs, and the check every site runs against its own configured renderer
2// (carrel/design-markdown-pipeline.md, section 5). Extended whenever a bypass is found; never shortened.
3//
4// The oracle is a parser, not a regex: a first regex scan of the original 44 reported 5 false positives (text such as `onerror=`
5// sitting inside an escaped attribute value). A pair of counts comes back with the result, so zero violations cannot mean zero read.
6
7import { ContentError } from "./render-error.mjs";
8import { scanHtml } from "./render-safe.mjs";
9
10/** @type {ReadonlyArray<{ name: string, source: string }>} */
11export const HOSTILE_INPUTS = [
12  { name: "raw script", source: "before\n\n<script>alert(1)</script>\n\nafter" },
13  { name: "inline script in prose", source: "text <script>alert(1)</script> text" },
14  { name: "img onerror", source: '<img src="x" onerror="alert(1)">' },
15  { name: "iframe", source: '<iframe src="https://example.com"></iframe>' },
16  { name: "style with url", source: '<style>body{background:url("https://example.com/x")}</style>' },
17  { name: "svg onload", source: '<svg onload="alert(1)"><circle r="5"/></svg>' },
18  { name: "form", source: '<form action="https://example.com"><input name="x"></form>' },
19  { name: "details ontoggle", source: "<details open ontoggle=\"alert(1)\"><summary>x</summary></details>" },
20  { name: "javascript link", source: "[x](javascript:alert(1))" },
21  { name: "javascript link, mixed case", source: "[x](JaVaScRiPt:alert(1))" },
22  { name: "javascript link, entity", source: "[x](&#106;avascript:alert(1))" },
23  { name: "javascript link, percent", source: "[x](%6Aavascript:alert(1))" },
24  { name: "javascript link, leading space", source: "[x](< javascript:alert(1)>)" },
25  { name: "javascript link, tab", source: "[x](<java\tscript:alert(1)>)" },
26  { name: "javascript link, null byte", source: "[x](<java\u0000script:alert(1)>)" },
27  { name: "data link", source: "[x](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)" },
28  { name: "vbscript link", source: "[x](vbscript:msgbox(1))" },
29  { name: "file link", source: "[x](file:///etc/passwd)" },
30  { name: "protocol-relative link", source: "[x](//example.com/x)" },
31  { name: "javascript image", source: "![x](javascript:alert(1))" },
32  { name: "data image", source: "![x](data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+)" },
33  { name: "javascript autolink", source: "<javascript:alert(1)>" },
34  { name: "javascript reference link", source: "[x][a]\n\n[a]: javascript:alert(1)" },
35  { name: "html in link text", source: "[<img src=x onerror=alert(1)>](https://example.com)" },
36  { name: "quote break in title", source: '[x](https://example.com "a\\" onmouseover=\\"alert(1)")' },
37  { name: "quote break in alt", source: '![a" onerror="alert(1)](https://example.com/x.png)' },
38  { name: "katex href", source: "$\\href{javascript:alert(1)}{x}$" },
39  { name: "katex url", source: "$\\url{javascript:alert(1)}$" },
40  { name: "katex htmlClass", source: "$\\htmlClass{evil}{x}$" },
41  { name: "katex htmlStyle", source: "$\\htmlStyle{background:url(https://example.com)}{x}$" },
42  { name: "katex includegraphics", source: "$\\includegraphics{https://example.com/x.png}$" },
43  { name: "unknown container directive", source: ":::evil\nx\n:::" },
44  { name: "unknown text directive", source: "a :alert(1) b" },
45  { name: "malformed directive", source: ":::figure{src=\"x\" onerror=\"alert(1)\"\nx\n:::" },
46  { name: "directive attributes carrying markup", source: ':::details{summary="<img src=x onerror=alert(1)>"}\nbody\n:::' },
47  {
48    name: "chart text carrying markup",
49    source:
50      ':::chart{type="bar" x="label" y="value" title="<script>alert(1)</script>" alt="<img src=x onerror=alert(1)>"}\n```csv\nlabel,value\n<img src=x onerror=alert(1)>,1\n<script>alert(1)</script>,2\n```\n:::',
51  },
52  { name: "diagram text carrying markup", source: ':::diagram{title="<script>alert(1)</script>" alt="<img src=x onerror=alert(1)>"}\n```mermaid\ngraph TD; A-->B\n```\n:::' },
53  { name: "code fence language", source: '```"><script>alert(1)</script>\ncode\n```' },
54  { name: "code fence meta", source: '```js {1} onmouseover="alert(1)"\ncode\n```' },
55  { name: "heading markup", source: "# <img src=x onerror=alert(1)>" },
56  { name: "footnote markup", source: "x[^1]\n\n[^1]: <script>alert(1)</script>" },
57  { name: "table cell markup", source: "| a |\n| - |\n| <img src=x onerror=alert(1)> |" },
58  { name: "comment breakout", source: "<!-- --><script>alert(1)</script><!-- -->" },
59  { name: "long bracket run", source: "[".repeat(20000) },
60];
61
62/**
63 * Renders every hostile input with the caller's own configured renderer and scans what comes out.
64 *
65 * @param {(source: string) => Promise<{ html: string }>} renderSource the site's renderer, configured as the site configures it
66 * @param {import("./render-safe.mjs").Allowlist} [allowlist]
67 * @returns {Promise<{
68 *   inputs: number,
69 *   rendered: number,
70 *   refused: string[],
71 *   elements: number,
72 *   attributes: number,
73 *   violations: Array<{ input: string, kind: string, tag: string, attribute?: string }>,
74 * }>}
75 */
76export async function runConformance(renderSource, allowlist) {
77  let rendered = 0;
78  let elements = 0;
79  let attributes = 0;
80  /** @type {string[]} */
81  const refused = [];
82  /** @type {Array<{ input: string, kind: string, tag: string, attribute?: string }>} */
83  const violations = [];
84
85  for (const { name, source } of HOSTILE_INPUTS) {
86    let html;
87    try {
88      ({ html } = await renderSource(source));
89    } catch (error) {
90      // A refusal (ContentError) is a safe outcome: nothing was produced. Anything else is a crash, which must not pass as a refusal.
91      if (!(error instanceof ContentError)) throw error;
92      refused.push(name);
93      continue;
94    }
95    rendered += 1;
96    const scan = scanHtml(html, allowlist);
97    elements += scan.elements;
98    attributes += scan.attributes;
99    for (const violation of scan.violations) violations.push({ input: name, ...violation });
100  }
101
102  return { inputs: HOSTILE_INPUTS.length, rendered, refused, elements, attributes, violations };
103}