shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): escape exported image data (#3819)

Browse Source 
Fixes #3811
This commit is contained in:
Justin Barnett
2026-04-27 17:22:06 -04:00
committed by GitHub
parent 13610d3893
commit 7617c1ad92
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/coding-agent/src/core/export-html/template.js
View File

@@ -881,7 +881,7 @@
const images = getResultImages();
if (images.length === 0) return '';
return '<div class="tool-images">' +
images.map(img => `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${img.data}" class="tool-image" />`).join('') +
images.map(img => `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${escapeHtml(img.data || '')}" class="tool-image" />`).join('') +
'</div>';
};
@@ -1148,7 +1148,7 @@
if (images.length > 0) {
html += '<div class="message-images">';
for (const img of images) {
html += `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${img.data}" class="message-image" />`;
html += `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${escapeHtml(img.data || '')}" class="message-image" />`;
}
html += '</div>';
}

6
packages/coding-agent/test/export-html-xss.test.ts
View File

@@ -25,4 +25,10 @@ describe("export HTML markdown link sanitization", () => {
expect(templateJs).not.toMatch(/\$\{img\.mimeType\}/);
expect(templateJs).toMatch(/escapeHtml\(img\.mimeType/);
});
it("escapes image data attributes", () => {
// Image data is embedded in src attributes and must not allow attribute breakout.
expect(templateJs).not.toMatch(/;base64,\$\{img\.data\}"/);
expect(templateJs).toMatch(/;base64,\$\{escapeHtml\(img\.data \|\| (?:''|"")\)\}"/);
});
});