@ts-graphviz/ast 3.0.5-next-dc3ef34316f5642c416711cb6a50704dbef7bb64 → 3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # @ts-graphviz/ast
 
-## 3.0.5-next-dc3ef34316f5642c416711cb6a50704dbef7bb64
+## 3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670
 
 ### Patch Changes
 
@@ -63,8 +63,62 @@
 
 - [#1532](https://github.com/ts-graphviz/ts-graphviz/pull/1532) [`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64) Thanks [@dependabot](https://github.com/apps/dependabot)! - build(deps-dev): bump vite from 7.0.2 to 7.0.8 in the npm_and_yarn group across 1 directory
 
+- [#1535](https://github.com/ts-graphviz/ts-graphviz/pull/1535) [`11f7126`](https://github.com/ts-graphviz/ts-graphviz/commit/11f7126347816f64f7892c8608b5e3bf1a826670) Thanks [@kamiazya](https://github.com/kamiazya)! - Fix comment injection vulnerability in block comments
+
+  Addresses security vulnerability where malicious `*/` sequences in comment content could break out of block comment context and inject arbitrary DOT syntax.
+
+  ## Security Enhancement
+
+  ### Comment Content Escaping
+
+  - Added `escapeComment()` utility function to sanitize comment content
+  - Block comments: Breaks up `*/` sequences using zero-width space (U+200B) to prevent early comment termination
+  - All comment types: Removes null bytes that could cause parsing issues
+  - Follows C/C++ and DOT language specifications where block comments cannot be nested
+
+  ## Changes
+
+  ### New Utility Function
+
+  - `escapeComment()` in `packages/ast/src/dot-shim/printer/plugins/utils/escape-comment.ts`
+  - Prevents comment injection by inserting zero-width space between `*` and `/`
+  - Maintains visual appearance while preventing syntax injection
+  - Verified to work with Graphviz 13.1.1
+
+  ### Updated Components
+
+  - `CommentPrintPlugin` now applies escaping before outputting comment content
+  - All comment values are sanitized at print time, not at creation time
+  - Maintains backward compatibility with existing AST structures
+
+  ### Testing
+
+  - 11 unit tests for `escapeComment()` function covering:
+    - Block comment injection prevention
+    - Multiple `*/` sequence handling
+    - Null byte removal
+    - Normal content preservation
+  - Integration tests in `stringify.test.ts` for end-to-end verification
+  - All existing tests continue to pass
+
+  ## Security Impact
+
+  - Prevents DOT syntax injection via malicious comment content
+  - Blocks attempts to escape comment context and inject arbitrary graph definitions
+  - Protects against parser manipulation through crafted comment values
+  - Zero-width space approach is standards-compliant and validated with official Graphviz parser
+
+  ## Technical Details
+
+  According to C/C++ and DOT language specifications, block comments (`/* */`) cannot be nested and there is no escape sequence for the closing delimiter within comments. The standard workaround is to insert a zero-width space (U+200B) between `*` and `/`, which:
+
+  - Prevents early comment termination
+  - Preserves visual appearance (zero-width character is invisible)
+  - Is correctly handled by Graphviz parser (tested with version 13.1.1)
+  - Follows industry best practices for comment sanitization
+
 - Updated dependencies [[`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64)]:
-  - @ts-graphviz/common@3.0.4-next-dc3ef34316f5642c416711cb6a50704dbef7bb64
+  - @ts-graphviz/common@3.0.4-next-11f7126347816f64f7892c8608b5e3bf1a826670
 
 ## 3.0.4
 

package/lib/ast.js

@@ -2865,6 +2865,14 @@ const AttributePrintPlugin = {
     yield ";";
   }
 };
+const ZERO_WIDTH_SPACE = "​";
+function escapeComment(value, kind) {
+  let escaped = value.replace(/\0/g, "");
+  if (kind === "Block") {
+    escaped = escaped.replace(/\*\//g, `*${ZERO_WIDTH_SPACE}/`);
+  }
+  return escaped;
+}
 const EOL_PATTERN = /\r?\n/;
 const paddingMap = {
   Block: " * ",
@@ -2880,7 +2888,8 @@ const CommentPrintPlugin = {
     if (ast.kind === "Block") {
       yield* ["/**", context.EOL];
     }
-    const lines = ast.value.split(EOL_PATTERN);
+    const escapedValue = escapeComment(ast.value, ast.kind);
+    const lines = escapedValue.split(EOL_PATTERN);
     const lineLength = lines.length;
     for (let i = 0; i < lineLength; i++) {
       yield padding;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-graphviz/ast",
-  "version": "3.0.5-next-dc3ef34316f5642c416711cb6a50704dbef7bb64",
+  "version": "3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670",
   "description": "Graphviz AST(Abstract Syntax Tree) Utilities",
   "keywords": [],
   "homepage": "https://github.com/ts-graphviz/ts-graphviz#readme",
@@ -33,7 +33,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ts-graphviz/common": "^3.0.4-next-dc3ef34316f5642c416711cb6a50704dbef7bb64"
+    "@ts-graphviz/common": "^3.0.4-next-11f7126347816f64f7892c8608b5e3bf1a826670"
   },
   "devDependencies": {
     "peggy": "^5.0.6",