@goodandready/dsh-image-gen 0.11.18 → 0.11.19

package/lib/frontend-assets.js

@@ -317,6 +317,20 @@ export function optimizeSvgContent(svgString, options = {}) {
   cleaned = cleaned.replace(/\s*(?:xmlns:inkscape|xmlns:sodipodi|xmlns:sketch|inkscape:[a-z-]+|sodipodi:[a-z-]+|sketch:[a-z-]+)="[^"]*"/gi, '')
   cleaned = cleaned.replace(/<(?:metadata|sodipodi:namedview)[\s\S]*?<\/(?:metadata|sodipodi:namedview)>/gi, '')
 
+  // Security (#374): Strip active/dangerous SVG tags (<script>, <foreignObject>, <iframe>, <embed>, <object>, <applet>)
+  cleaned = cleaned.replace(/<script[\s\S]*?<\/script>/gi, '')
+  cleaned = cleaned.replace(/<script[^>]*\/?>/gi, '')
+  cleaned = cleaned.replace(/<foreignObject[\s\S]*?<\/foreignObject>/gi, '')
+  cleaned = cleaned.replace(/<foreignObject[^>]*\/?>/gi, '')
+  cleaned = cleaned.replace(/<(?:iframe|embed|object|applet)[\s\S]*?<\/(?:iframe|embed|object|applet)>/gi, '')
+  cleaned = cleaned.replace(/<(?:iframe|embed|object|applet)[^>]*\/?>/gi, '')
+
+  // Strip event handler attributes (onload, onerror, onclick, etc.)
+  cleaned = cleaned.replace(/\s+on[a-z]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
+
+  // Strip dangerous URI schemes (javascript:, data:text/html, vbscript:) in href/xlink:href/src/action
+  cleaned = cleaned.replace(/\s+(?:href|xlink:href|src|action)\s*=\s*(?:"\s*(?:javascript|data:text\/html|vbscript):[^"]*"|'\s*(?:javascript|data:text\/html|vbscript):[^']*')/gi, '')
+
   cleaned = cleaned.replace(/\s{2,}/g, ' ')
   cleaned = cleaned.replace(/>\s+</g, '><')
 

package/lib/resolve-image.js

@@ -1,4 +1,4 @@
-import { readFile, stat } from 'node:fs/promises'
+import { readFile, stat, realpath } from 'node:fs/promises'
 import path from 'node:path'
 import { estimateSharpnessAndVariance } from './providers.js'
 
@@ -186,14 +186,24 @@ export async function resolveConversationImage(ctx, exec, targetRef) {
   }
 
   // 3. Local filesystem resolution with strict workspace containment check
-  const root = sessionCwd ? path.resolve(sessionCwd) : process.cwd()
+  const root = path.resolve(sessionCwd ? sessionCwd : process.cwd())
   const absPath = path.resolve(root, effectiveRef)
   const rel = path.relative(root, absPath)
   if (rel.startsWith('..') || path.isAbsolute(rel)) {
     throw new Error(`Access denied: path "${effectiveRef}" is outside allowed workspace directory "${root}"`)
   }
 
-  const fileStat = await stat(absPath).catch(() => null)
+  const realRoot = await realpath(root).catch(() => root)
+  const realTarget = await realpath(absPath).catch(() => null)
+  if (!realTarget) {
+    throw new Error(`Image file not found: ${effectiveRef}`)
+  }
+  const relReal = path.relative(realRoot, realTarget)
+  if (relReal.startsWith('..') || path.isAbsolute(relReal)) {
+    throw new Error(`Access denied: path "${effectiveRef}" points outside allowed workspace directory "${realRoot}"`)
+  }
+
+  const fileStat = await stat(realTarget).catch(() => null)
   if (!fileStat) {
     throw new Error(`Image file not found: ${effectiveRef}`)
   }
@@ -208,7 +218,7 @@ export async function resolveConversationImage(ctx, exec, targetRef) {
     throw new Error(`Image file too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
   }
 
-  const bytes = await readFile(absPath)
+  const bytes = await readFile(realTarget)
   validateImageSignature(bytes, effectiveRef)
   const mediaType = detectMediaType(absPath, bytes)
   return {

package/lib/resolve-source.js

@@ -1,7 +1,7 @@
 // lib/resolve-source.js — Safe image source resolution for image tools (#317)
 
 import path from 'node:path'
-import { readFile, stat } from 'node:fs/promises'
+import { readFile, stat, realpath } from 'node:fs/promises'
 import { validateImageSignature } from './resolve-image.js'
 
 /** Read source image for editing: filesystem path or attachment id. */
@@ -41,7 +41,17 @@ export async function resolveSource(ctx, exec, ref) {
     throw new Error(`Access denied: path "${ref}" is outside allowed workspace directory "${root}"`)
   }
 
-  const fileStat = await stat(target).catch(() => null)
+  const realRoot = await realpath(root).catch(() => root)
+  const realTarget = await realpath(target).catch(() => null)
+  if (!realTarget) {
+    throw new Error(`Source image not found: ${ref}`)
+  }
+  const relReal = path.relative(realRoot, realTarget)
+  if (relReal.startsWith('..') || path.isAbsolute(relReal)) {
+    throw new Error(`Access denied: path "${ref}" points outside allowed workspace directory "${realRoot}"`)
+  }
+
+  const fileStat = await stat(realTarget).catch(() => null)
   if (!fileStat) {
     throw new Error(`Source image not found: ${ref}`)
   }
@@ -55,7 +65,7 @@ export async function resolveSource(ctx, exec, ref) {
     throw new Error(`Source image too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
   }
 
-  const bytes = await readFile(target)
+  const bytes = await readFile(realTarget)
   validateImageSignature(bytes, ref)
   const ext = path.extname(target).toLowerCase()
   const mediaType = ext === '.jpg' || ext === '.jpeg' ? 'image/jpeg'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.18",
+  "version": "0.11.19",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",