Overview - Ghost

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
29732
cb6fba97 🐛 Fixed SVG favicons not rendering in bookmark cards
by Princi Ver...
Failed
29732
45afa668 🐛 Fixed SVG favicons not rendering in bookmark cards
by Princi Ver...
Succeeded
29732
05583555 Fixed unbounded raster output from extreme SVG aspect ratios ref https://linear.app/ghost/issue/HKG-1836/ The input cap bounded what we parse but nothing bounded what we produce. Passing only a width let the output height follow the source, so a 266 byte SVG declaring a 1000x8000 canvas filled with feTurbulence noise rendered to a 30MB PNG — 121,000x amplification, 272MB of peak RSS, and every reader of the post then downloading it. Well under the 32KB input cap, so that cap could not see it coming. Constraining both dimensions bounds the output absolutely: the same payload now produces 241KB at 256x256 in 93ms, and no input can exceed that. 256x256 is also what the `icon` entry in imageOptimization.internalImageSizes specifies. Also notes in the doc comment that the naming invariant covers SVG only. `.html` and `.xhtml` from an attacker's URL are still stored verbatim and served executable from the site's own origin — unchanged from main and out of scope here, but the comment read as though the origin were now safe in general.
by Princi Ver...
Succeeded
29732
34f62822 Fixed the attribute cap counting the wrong thing ref https://linear.app/ghost/issue/HKG-1836/ The cap added in the previous commit counted `=` characters, but an HTML attribute needs no value: `<g foo bar baz>` is three attributes and no `=`. So 16k valueless attributes on one element passed all three caps — 65KB, three elements, one `=` — blocked the event loop for 2.1 seconds and were then stored successfully. The cap was bypassed by exactly the payload it was written to stop, and the test used the `=` form so nothing caught it. Attributes are now counted as whitespace-separated tokens inside a tag, with quoted values skipped so that path data, which is mostly spaces, does not read as thousands of attributes. The same payload is now rejected in 4ms, a 3000 point path still stores, and both attribute forms have tests. Also corrects three figures in the comments that justify these bounds. They were measured before the last two commits and had drifted: the caps are worth ~13s (elements) and ~0.9s (attributes) against ~175ms with both, the repo's 99th percentile is 168 attributes rather than 801, and the validity-check ReDoS reaches 257s on repeated `<svg>` rather than the 5s first measured.
by Princi Ver...
Succeeded
29732
319b3ce4 Fixed the attribute cap counting the wrong thing ref https://linear.app/ghost/issue/HKG-1836/ The cap added in the previous commit counted `=` characters, but an HTML attribute needs no value: `<g foo bar baz>` is three attributes and no `=`. So 16k valueless attributes on one element passed all three caps — 65KB, three elements, one `=` — blocked the event loop for 2.1 seconds and were then stored successfully. The cap was bypassed by exactly the payload it was written to stop, and the test used the `=` form so nothing caught it. Attributes are now counted as whitespace-separated tokens inside a tag, with quoted values skipped so that path data, which is mostly spaces, does not read as thousands of attributes. The same payload is now rejected in 4ms, a 3000 point path still stores, and both attribute forms have tests. Also corrects three figures in the comments that justify these bounds. They were measured before the last two commits and had drifted: the caps are worth ~13s (elements) and ~0.9s (attributes) against ~175ms with both, the repo's 99th percentile is 168 attributes rather than 801, and the validity-check ReDoS reaches 257s on repeated `<svg>` rather than the 5s first measured.
by Princi Ver...