From 1cc54b3bbfa9dcf33e4c34a732e2091b1c0981d1 Mon Sep 17 00:00:00 2001 From: Safi Date: Wed, 8 Apr 2026 19:53:10 +0100 Subject: [PATCH] fix: XSS in legend innerHTML and shebang allowlist in hooks --- graphify/export.py | 2 +- graphify/hooks.py | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/graphify/export.py b/graphify/export.py index d363aa3c..d7a7349a 100644 --- a/graphify/export.py +++ b/graphify/export.py @@ -365,7 +365,7 @@ def to_html( legend_data = [] for cid in sorted((community_labels or {}).keys()): color = COMMUNITY_COLORS[cid % len(COMMUNITY_COLORS)] - lbl = (community_labels or {}).get(cid, f"Community {cid}") + lbl = _html.escape(sanitize_label((community_labels or {}).get(cid, f"Community {cid}"))) n = len(communities.get(cid, [])) legend_data.append({"cid": cid, "color": color, "label": lbl, "count": n}) diff --git a/graphify/hooks.py b/graphify/hooks.py index 51959ffb..f2c74e3c 100644 --- a/graphify/hooks.py +++ b/graphify/hooks.py @@ -17,6 +17,11 @@ if [ -n "$GRAPHIFY_BIN" ]; then */env\\ *) GRAPHIFY_PYTHON="${_SHEBANG#*/env }" ;; *) GRAPHIFY_PYTHON="$_SHEBANG" ;; esac + # Allowlist: only keep characters valid in a filesystem path to prevent + # injection if the shebang contains shell metacharacters + case "$GRAPHIFY_PYTHON" in + *[!a-zA-Z0-9/_.-]*) GRAPHIFY_PYTHON="python3" ;; + esac if ! "$GRAPHIFY_PYTHON" -c "import graphify" 2>/dev/null; then GRAPHIFY_PYTHON="python3" fi