mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-06-24 10:52:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

fix(security): sanitize kanban markdown html

Browse source
This commit is contained in:
峯岸　亮 2026-06-06 01:33:15 +09:00 • committed by Teknium
parent 8e4d2fd23f
commit 5b45fb269a
2 changed files with 56 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/plugins/test_kanban_dashboard_plugin.py
View file

@ -247,6 +247,19 @@ def test_dashboard_initial_board_uses_backend_current_when_unpinned():
assert 'readSelectedBoard() || "default"' not in js
def test_dashboard_markdown_html_is_sanitized_before_render():
"""Markdown rendering must sanitize HTML before dangerouslySetInnerHTML."""
repo_root = Path(__file__).resolve().parents[2]
bundle = repo_root / "plugins" / "kanban" / "dashboard" / "dist" / "index.js"
js = bundle.read_text()
assert "function sanitizeMarkdownHtml(html)" in js
assert "MARKDOWN_ALLOWED_TAGS" in js
assert "sanitizeMarkdownHtml(renderMarkdown(props.source || \"\"))" in js
assert "dangerouslySetInnerHTML: { __html: renderMarkdown(props.source || \"\") }" not in js
# ---------------------------------------------------------------------------
# GET /tasks/:id returns body + comments + events + links
# ---------------------------------------------------------------------------