@ts-graphviz/ast 3.0.5-next-dc3ef34316f5642c416711cb6a50704dbef7bb64 → 3.0.5-next-4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a

package/CHANGELOG.md

@@ -1,9 +1,71 @@
 # @ts-graphviz/ast
 
-## 3.0.5-next-dc3ef34316f5642c416711cb6a50704dbef7bb64
+## 3.0.5-next-4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a
 
 ### Patch Changes
 
+- [#1536](https://github.com/ts-graphviz/ts-graphviz/pull/1536) [`4296b4e`](https://github.com/ts-graphviz/ts-graphviz/commit/4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a) Thanks [@kamiazya](https://github.com/kamiazya)! - Add null byte sanitization and comprehensive security tests for DOT injection prevention
+
+  ## Security Fix
+
+  ### Null Byte Handling
+
+  Added null byte removal to the `escape()` function to prevent Graphviz parsing errors. Graphviz treats null bytes (`\0`) as string terminators, causing syntax errors when encountered in quoted strings. This is now consistent with the `escapeComment()` function which already strips null bytes.
+
+  **Why this matters:**
+
+  - Prevents "syntax error in line X scanning a quoted string" errors in Graphviz
+  - Removes potential attack vector for causing parser failures
+  - Aligns with existing comment sanitization behavior
+
+  ## Test Coverage Additions
+
+  ### Unit Tests (escape.test.ts)
+
+  Added 16 new test cases covering various DOT injection attack vectors:
+
+  - Semicolon-based statement injection
+  - Edge operator injection attempts
+  - Graph termination injection via quotes and newlines
+  - Closing brace injection
+  - Attribute injection with equals sign
+  - Multiple quote injection attempts
+  - Mixed newlines and quotes
+  - Subgraph injection attempts
+  - Edge chain injection
+  - HTML-like label injection with quotes
+  - Port injection
+  - Already-escaped string handling
+  - Null byte removal (2 tests)
+  - Unicode strings with quotes
+  - Strict keyword injection
+
+  ### Integration Tests (to-dot.test.ts)
+
+  Added 10 new end-to-end test cases:
+
+  - Statement injection in node IDs (semicolon)
+  - Edge operator injection in node IDs
+  - Graph termination injection via quotes and newlines
+  - Statement injection in subgraph IDs
+  - Attribute value injection prevention
+  - Edge ID injection prevention
+  - Multiple quotes in node ID
+  - Port specification injection
+  - Graph comment injection
+  - Node comment injection
+
+  ## Validation
+
+  All tests confirm that the existing escape implementation correctly prevents DOT language injection by:
+
+  - Escaping double quotes (`"` → `\"`)
+  - Escaping newlines (`\n` → `\n`)
+  - Escaping carriage returns (`\r` → `\r`)
+  - Ensuring malicious strings are treated as literal identifiers, not DOT syntax
+
+  Verified with actual Graphviz parser (version 13.1.1) that escaped output renders safely without executing injected DOT code.
+
 - [#1533](https://github.com/ts-graphviz/ts-graphviz/pull/1533) [`ed770be`](https://github.com/ts-graphviz/ts-graphviz/commit/ed770be7fffc93b9171198c9a84270df7477185d) Thanks [@kamiazya](https://github.com/kamiazya)! - Add memory exhaustion protection with input size and AST node count limits
 
   Addresses security vulnerability where extremely large inputs or inputs with excessive elements could cause memory exhaustion, leading to application crashes and potential DoS attacks.
@@ -63,8 +125,62 @@
 
 - [#1532](https://github.com/ts-graphviz/ts-graphviz/pull/1532) [`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64) Thanks [@dependabot](https://github.com/apps/dependabot)! - build(deps-dev): bump vite from 7.0.2 to 7.0.8 in the npm_and_yarn group across 1 directory
 
+- [#1535](https://github.com/ts-graphviz/ts-graphviz/pull/1535) [`11f7126`](https://github.com/ts-graphviz/ts-graphviz/commit/11f7126347816f64f7892c8608b5e3bf1a826670) Thanks [@kamiazya](https://github.com/kamiazya)! - Fix comment injection vulnerability in block comments
+
+  Addresses security vulnerability where malicious `*/` sequences in comment content could break out of block comment context and inject arbitrary DOT syntax.
+
+  ## Security Enhancement
+
+  ### Comment Content Escaping
+
+  - Added `escapeComment()` utility function to sanitize comment content
+  - Block comments: Breaks up `*/` sequences using zero-width space (U+200B) to prevent early comment termination
+  - All comment types: Removes null bytes that could cause parsing issues
+  - Follows C/C++ and DOT language specifications where block comments cannot be nested
+
+  ## Changes
+
+  ### New Utility Function
+
+  - `escapeComment()` in `packages/ast/src/dot-shim/printer/plugins/utils/escape-comment.ts`
+  - Prevents comment injection by inserting zero-width space between `*` and `/`
+  - Maintains visual appearance while preventing syntax injection
+  - Verified to work with Graphviz 13.1.1
+
+  ### Updated Components
+
+  - `CommentPrintPlugin` now applies escaping before outputting comment content
+  - All comment values are sanitized at print time, not at creation time
+  - Maintains backward compatibility with existing AST structures
+
+  ### Testing
+
+  - 11 unit tests for `escapeComment()` function covering:
+    - Block comment injection prevention
+    - Multiple `*/` sequence handling
+    - Null byte removal
+    - Normal content preservation
+  - Integration tests in `stringify.test.ts` for end-to-end verification
+  - All existing tests continue to pass
+
+  ## Security Impact
+
+  - Prevents DOT syntax injection via malicious comment content
+  - Blocks attempts to escape comment context and inject arbitrary graph definitions
+  - Protects against parser manipulation through crafted comment values
+  - Zero-width space approach is standards-compliant and validated with official Graphviz parser
+
+  ## Technical Details
+
+  According to C/C++ and DOT language specifications, block comments (`/* */`) cannot be nested and there is no escape sequence for the closing delimiter within comments. The standard workaround is to insert a zero-width space (U+200B) between `*` and `/`, which:
+
+  - Prevents early comment termination
+  - Preserves visual appearance (zero-width character is invisible)
+  - Is correctly handled by Graphviz parser (tested with version 13.1.1)
+  - Follows industry best practices for comment sanitization
+
 - Updated dependencies [[`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64)]:
-  - @ts-graphviz/common@3.0.4-next-dc3ef34316f5642c416711cb6a50704dbef7bb64
+  - @ts-graphviz/common@3.0.4-next-4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a
 
 ## 3.0.4
 

package/lib/ast.js

@@ -2865,6 +2865,14 @@ const AttributePrintPlugin = {
     yield ";";
   }
 };
+const ZERO_WIDTH_SPACE = "​";
+function escapeComment(value, kind) {
+  let escaped = value.replace(/\0/g, "");
+  if (kind === "Block") {
+    escaped = escaped.replace(/\*\//g, `*${ZERO_WIDTH_SPACE}/`);
+  }
+  return escaped;
+}
 const EOL_PATTERN = /\r?\n/;
 const paddingMap = {
   Block: " * ",
@@ -2880,7 +2888,8 @@ const CommentPrintPlugin = {
     if (ast.kind === "Block") {
       yield* ["/**", context.EOL];
     }
-    const lines = ast.value.split(EOL_PATTERN);
+    const escapedValue = escapeComment(ast.value, ast.kind);
+    const lines = escapedValue.split(EOL_PATTERN);
     const lineLength = lines.length;
     for (let i = 0; i < lineLength; i++) {
       yield padding;
@@ -2938,7 +2947,7 @@ const GraphPrintPlugin = {
     yield "}";
   }
 };
-const escape = (value) => value.replace(/(?<!\\)"|[\r\n]/g, escapeReplacer);
+const escape = (value) => value.replace(/\0/g, "").replace(/(?<!\\)"|[\r\n]/g, escapeReplacer);
 const escapeMap = {
   "\r": String.raw`\r`,
   "\n": String.raw`\n`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-graphviz/ast",
-  "version": "3.0.5-next-dc3ef34316f5642c416711cb6a50704dbef7bb64",
+  "version": "3.0.5-next-4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a",
   "description": "Graphviz AST(Abstract Syntax Tree) Utilities",
   "keywords": [],
   "homepage": "https://github.com/ts-graphviz/ts-graphviz#readme",
@@ -33,7 +33,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ts-graphviz/common": "^3.0.4-next-dc3ef34316f5642c416711cb6a50704dbef7bb64"
+    "@ts-graphviz/common": "^3.0.4-next-4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a"
   },
   "devDependencies": {
     "peggy": "^5.0.6",