ts-graphviz 3.0.6-next-11f7126347816f64f7892c8608b5e3bf1a826670 → 3.0.6-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +68 -6
  2. package/package.json +5 -5
package/CHANGELOG.md CHANGED
@@ -1,16 +1,78 @@
1
1
  # ts-graphviz
2
2
 
3
- ## 3.0.6-next-11f7126347816f64f7892c8608b5e3bf1a826670
3
+ ## 3.0.6-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec
4
4
 
5
5
  ### Patch Changes
6
6
 
7
+ - [#1536](https://github.com/ts-graphviz/ts-graphviz/pull/1536) [`4296b4e`](https://github.com/ts-graphviz/ts-graphviz/commit/4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a) Thanks [@kamiazya](https://github.com/kamiazya)! - Add null byte sanitization and comprehensive security tests for DOT injection prevention
8
+
9
+ ## Security Fix
10
+
11
+ ### Null Byte Handling
12
+
13
+ Added null byte removal to the `escape()` function to prevent Graphviz parsing errors. Graphviz treats null bytes (`\0`) as string terminators, causing syntax errors when encountered in quoted strings. This is now consistent with the `escapeComment()` function which already strips null bytes.
14
+
15
+ **Why this matters:**
16
+
17
+ - Prevents "syntax error in line X scanning a quoted string" errors in Graphviz
18
+ - Removes potential attack vector for causing parser failures
19
+ - Aligns with existing comment sanitization behavior
20
+
21
+ ## Test Coverage Additions
22
+
23
+ ### Unit Tests (escape.test.ts)
24
+
25
+ Added 16 new test cases covering various DOT injection attack vectors:
26
+
27
+ - Semicolon-based statement injection
28
+ - Edge operator injection attempts
29
+ - Graph termination injection via quotes and newlines
30
+ - Closing brace injection
31
+ - Attribute injection with equals sign
32
+ - Multiple quote injection attempts
33
+ - Mixed newlines and quotes
34
+ - Subgraph injection attempts
35
+ - Edge chain injection
36
+ - HTML-like label injection with quotes
37
+ - Port injection
38
+ - Already-escaped string handling
39
+ - Null byte removal (2 tests)
40
+ - Unicode strings with quotes
41
+ - Strict keyword injection
42
+
43
+ ### Integration Tests (to-dot.test.ts)
44
+
45
+ Added 10 new end-to-end test cases:
46
+
47
+ - Statement injection in node IDs (semicolon)
48
+ - Edge operator injection in node IDs
49
+ - Graph termination injection via quotes and newlines
50
+ - Statement injection in subgraph IDs
51
+ - Attribute value injection prevention
52
+ - Edge ID injection prevention
53
+ - Multiple quotes in node ID
54
+ - Port specification injection
55
+ - Graph comment injection
56
+ - Node comment injection
57
+
58
+ ## Validation
59
+
60
+ All tests confirm that the existing escape implementation correctly prevents DOT language injection by:
61
+
62
+ - Escaping double quotes (`"` → `\"`)
63
+ - Escaping newlines (`\n` → `\n`)
64
+ - Escaping carriage returns (`\r` → `\r`)
65
+ - Ensuring malicious strings are treated as literal identifiers, not DOT syntax
66
+
67
+ Verified with actual Graphviz parser (version 13.1.1) that escaped output renders safely without executing injected DOT code.
68
+
7
69
  - [#1532](https://github.com/ts-graphviz/ts-graphviz/pull/1532) [`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64) Thanks [@dependabot](https://github.com/apps/dependabot)! - build(deps-dev): bump vite from 7.0.2 to 7.0.8 in the npm_and_yarn group across 1 directory
8
70
 
9
- - Updated dependencies [[`ed770be`](https://github.com/ts-graphviz/ts-graphviz/commit/ed770be7fffc93b9171198c9a84270df7477185d), [`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64), [`11f7126`](https://github.com/ts-graphviz/ts-graphviz/commit/11f7126347816f64f7892c8608b5e3bf1a826670)]:
10
- - @ts-graphviz/ast@3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670
11
- - @ts-graphviz/adapter@3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670
12
- - @ts-graphviz/common@3.0.4-next-11f7126347816f64f7892c8608b5e3bf1a826670
13
- - @ts-graphviz/core@3.0.6-next-11f7126347816f64f7892c8608b5e3bf1a826670
71
+ - Updated dependencies [[`4296b4e`](https://github.com/ts-graphviz/ts-graphviz/commit/4296b4e0cf17f36cc385c2ce93ec7ec89bd4a73a), [`ed770be`](https://github.com/ts-graphviz/ts-graphviz/commit/ed770be7fffc93b9171198c9a84270df7477185d), [`dc3ef34`](https://github.com/ts-graphviz/ts-graphviz/commit/dc3ef34316f5642c416711cb6a50704dbef7bb64), [`11f7126`](https://github.com/ts-graphviz/ts-graphviz/commit/11f7126347816f64f7892c8608b5e3bf1a826670)]:
72
+ - @ts-graphviz/ast@3.0.5-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec
73
+ - @ts-graphviz/adapter@3.0.5-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec
74
+ - @ts-graphviz/common@3.0.4-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec
75
+ - @ts-graphviz/core@3.0.6-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec
14
76
 
15
77
  ## 3.0.5
16
78
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ts-graphviz",
3
- "version": "3.0.6-next-11f7126347816f64f7892c8608b5e3bf1a826670",
3
+ "version": "3.0.6-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec",
4
4
  "description": "Graphviz library for TypeScript",
5
5
  "keywords": [
6
6
  "graphviz",
@@ -45,10 +45,10 @@
45
45
  "./package.json": "./package.json"
46
46
  },
47
47
  "dependencies": {
48
- "@ts-graphviz/adapter": "^3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670",
49
- "@ts-graphviz/ast": "^3.0.5-next-11f7126347816f64f7892c8608b5e3bf1a826670",
50
- "@ts-graphviz/common": "^3.0.4-next-11f7126347816f64f7892c8608b5e3bf1a826670",
51
- "@ts-graphviz/core": "^3.0.6-next-11f7126347816f64f7892c8608b5e3bf1a826670"
48
+ "@ts-graphviz/adapter": "^3.0.5-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec",
49
+ "@ts-graphviz/ast": "^3.0.5-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec",
50
+ "@ts-graphviz/common": "^3.0.4-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec",
51
+ "@ts-graphviz/core": "^3.0.6-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec"
52
52
  },
53
53
  "devDependencies": {
54
54
  "typescript": "^5.8.2",