shadowdaoandClaude Opus 4.8
591a51dcc2
An adversarial pass found 5 Critical XSS sinks where props declared number/enum in TypeScript were interpolated raw into exported HTML attribute values, trusting the type — but nothing enforces it at runtime (AI update_props only validates node_id; deserialized saved state is untyped JSON). Fixed all 5 (NumberCounter data-target, StarRating aria-label, FormContainer method, ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive audit of every attribute-value interpolation across src/components: a JS-source injection into ContentSlider's inline setInterval script, a prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup, TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue primitives. Every fix is TDD'd: a malicious-value test reproduces the raw injection against the pre-fix code, then passes after the fix. 502 tests green (npx vitest run), tsc + vite build green (npm run build). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
107 lines
2.9 KiB
TypeScript
107 lines
2.9 KiB
TypeScript
import React, { CSSProperties } from 'react';
|
|
import { useNode, UserComponent } from '@craftjs/core';
|
|
import { cssPropsToString } from '../../utils/style-helpers';
|
|
import { escapeAttr, safeUrl } from '../../utils/escape';
|
|
|
|
interface MapEmbedProps {
|
|
address?: string;
|
|
zoom?: number;
|
|
height?: string;
|
|
style?: CSSProperties;
|
|
}
|
|
|
|
function buildMapUrl(address: string, zoom: number): string {
|
|
const encoded = encodeURIComponent(address);
|
|
// `zoom` is declared as `number` but is not runtime-type-checked (AI
|
|
// update_props / deserialized state can hand us anything). The final src
|
|
// string is still run through escapeAttr(safeUrl(...)) at the toHtml call
|
|
// site, which already blocks attribute-breakout -- but Number-coercing
|
|
// here too keeps the emitted URL a well-formed `z=<digits>` query param
|
|
// instead of smuggling arbitrary attacker text into it.
|
|
const z = Number(zoom);
|
|
const safeZoom = Number.isFinite(z) ? z : 14;
|
|
return `https://maps.google.com/maps?q=${encoded}&z=${safeZoom}&output=embed`;
|
|
}
|
|
|
|
export const MapEmbed: UserComponent<MapEmbedProps> = ({
|
|
address = 'New York, NY',
|
|
zoom = 14,
|
|
height = '400px',
|
|
style = {},
|
|
}) => {
|
|
const {
|
|
connectors: { connect, drag },
|
|
selected,
|
|
} = useNode((node) => ({
|
|
selected: node.events.selected,
|
|
}));
|
|
|
|
return (
|
|
<div
|
|
ref={(ref: HTMLDivElement | null): void => { if (ref) connect(drag(ref)); }}
|
|
style={{
|
|
width: '100%',
|
|
outline: selected ? '2px solid #3b82f6' : 'none',
|
|
...style,
|
|
}}
|
|
>
|
|
<iframe
|
|
src={buildMapUrl(address, zoom)}
|
|
style={{
|
|
width: '100%',
|
|
height,
|
|
border: 'none',
|
|
borderRadius: (style as any)?.borderRadius || '0px',
|
|
display: 'block',
|
|
}}
|
|
loading="lazy"
|
|
referrerPolicy="no-referrer-when-downgrade"
|
|
allowFullScreen
|
|
/>
|
|
</div>
|
|
);
|
|
};
|
|
|
|
/* ---------- Craft config ---------- */
|
|
|
|
MapEmbed.craft = {
|
|
displayName: 'Map',
|
|
props: {
|
|
address: 'New York, NY',
|
|
zoom: 14,
|
|
height: '400px',
|
|
style: {},
|
|
},
|
|
rules: {
|
|
canDrag: () => true,
|
|
canMoveIn: () => false,
|
|
canMoveOut: () => true,
|
|
},
|
|
};
|
|
|
|
/* ---------- HTML export ---------- */
|
|
|
|
(MapEmbed as any).toHtml = (props: MapEmbedProps, _childrenHtml: string) => {
|
|
const {
|
|
address = 'New York, NY',
|
|
zoom = 14,
|
|
height = '400px',
|
|
style = {},
|
|
} = props;
|
|
|
|
const wrapperStyle = cssPropsToString({ width: '100%', ...style });
|
|
const iframeStyle = cssPropsToString({
|
|
width: '100%',
|
|
height,
|
|
border: 'none',
|
|
borderRadius: (style as any)?.borderRadius || undefined,
|
|
display: 'block',
|
|
});
|
|
|
|
const src = buildMapUrl(address, zoom);
|
|
|
|
return {
|
|
html: `<div${wrapperStyle ? ` style="${wrapperStyle}"` : ''}><iframe src="${escapeAttr(safeUrl(src))}" title="${escapeAttr(`Map of ${address}`)}" loading="lazy" referrerpolicy="no-referrer-when-downgrade" allowfullscreen${iframeStyle ? ` style="${iframeStyle}"` : ''}></iframe></div>`,
|
|
};
|
|
};
|