Repository navigation
v0.3.3 — attachment path safety + CI Node-24 action runtimes - #3
Merged
Merged
Conversation
…tive The v0.3.2 pass guarded the page/plan/member/header links but missed the attachment attributes: report.html set trace `href = encodeURI(t)` and screenshot `src = encodeURI(p)` straight from result.json. encodeURI does not strip schemes, so a crafted/shared report turned traces:["javascript:alert(1)"] into a live clickable self-XSS link (and data:/path-traversal into image sources / escape links). Reproduced in Chromium: a rendered report exposed a javascript: trace anchor. safeArtifact() now admits only local-relative artifact paths: it rejects any scheme, protocol-relative //host, absolute path, backslash separator and ".." traversal, and is used for the trace href + download and the screenshot src (and thus the lightbox). Legitimate artifacts such as artifacts/traces/legit.zip and artifacts/screenshots/legit.png keep their normal working anchor/image — no blanket disabling of attachments. Tests: real-browser audit asserts zero javascript:/data: anchors and image sources and no traversal, while confirming normal local trace + screenshot still render and clicking the safe trace fires nothing. Closes the v0.3.2 coverage gap (attachment fields were previously untested).
…ers) GitHub removed Node 20 from hosted runners on 2026-09-16; the pinned checkout@v4 / setup-node@v4 / upload-artifact@v4 / configure-pages@v5 / deploy-pages@v4 are Node-20 actions now force-run on Node 24 (with deprecation warnings). Upgraded to the minimal Node-24 majors verified from each action's own action.yml `runs.using: node24`: checkout@v5, setup-node@v5, upload-artifact@v6 (v5 is still node20), configure-pages@v6, deploy-pages@v5. upload-pages-artifact stays (composite action, unaffected). The project's Node 20 & 22 build/test matrix is unchanged; behavior of these steps is drop-in and will be re-verified on all four CI platforms.
Bump 0.3.2 -> 0.3.3. CHANGELOG records the attachment path-safety fix (security) and the CI action-runtime maintenance. Update README (en + zh) Status and the compatibility matrix with the real counts (137/137) and the Node-24 action note.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two focused changes on the verified v0.3.2 base.
SECURITY (fixes real defect): report.html set trace
hrefand screenshotsrcfrom result.json using only encodeURI, so a crafted/shared report could expose a clickable javascript: trace link (self-XSS) or data:/path-traversal images. Reproduced in Chromium, then fixed with one safeArtifact() guard (scheme/protocol-relative/absolute/backslash/'..' rejected) applied to trace href+download, screenshot src and the lightbox. Normal local artifacts still work. Tests 136 -> 137.CI MAINTENANCE: Node 20 removed from GitHub runners (2026-09-16). Moved to the minimal Node-24 majors verified from each action's action.yml
runs.using: checkout@v5, setup-node@v5, upload-artifact@v6 (v5 still node20), configure-pages@v6, deploy-pages@v5. upload-pages-artifact is composite (unchanged). Project Node 20/22 test matrix preserved. This PR's 4-platform CI run also verifies the new action versions actually work.Version/docs/lock -> 0.3.3.
Head: a059eef