Bump svgo to 3.3.5 in the docs site to fix GHSA-w27v-7q3p-w38r - #183
Merged
Merged
Conversation
The docs site pulled svgo 3.3.4 transitively through @svgr/plugin-svgo and postcss-svgo. That version's removeScripts plugin missed namespace-prefixed anchors (<svg:a href="...">) and URL schemes containing embedded tabs, line feeds, or carriage returns (java	script:), so executable links could survive optimization. Pin svgo to ^3.3.5 with an override, alongside the existing minimatch, serialize-javascript, and uuid pins, so the patched version stays in place as the transitive ranges (^3.0.2 and ^3.2.0) continue to resolve. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ELjK1ZcXrvTuv59mkf4d9S
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-w27v-7q3p-w38r (CVE-2026-84370, High, CVSS 8.2).
The problem
src/CrestApps.Core.Docsresolved svgo 3.3.4 transitively, through two paths:@docusaurus/preset-classic→@svgr/webpack→@svgr/plugin-svgo(svgo: ^3.0.2)@docusaurus/core→cssnano-preset-advanced→postcss-svgo(svgo: ^3.2.0)In that version the
removeScriptsplugin failed to strip executable links two ways:<a>elements, so a namespace-prefixed<svg:a href="javascript:...">kept itshref.java	script:slipped past thejavascript:check while browsers still parsed it as a script URL.An app that optimizes attacker-supplied SVGs with that plugin and then serves them in a browser context could execute script in the SVG's origin.
The fix
"svgo": "^3.3.5"to the existingoverridesblock insrc/CrestApps.Core.Docs/package.json, alongside theminimatch,serialize-javascript, anduuidpins already there. Both transitive ranges (^3.0.2and^3.2.0) accept 3.3.5, so the override keeps the patched version in place rather than fighting the resolver.src/CrestApps.Core.Docs/package-lock.jsonto svgo 3.3.5. The dependency set is unchanged between 3.3.4 and 3.3.5, so this is a three-line change toversion/resolved/integritywith no downstream churn.The root
package-lock.jsondoes not contain svgo, so no change was needed there.Verification
npm ci --dry-runinsrc/CrestApps.Core.Docssucceeds and resolvessvgo 3.3.5, confirmingpackage.jsonand the lockfile are in sync.plugins/removeScriptElement.jsnow carries the namespace-aware element matching (isNamespaceAwareElem,ANCHOR_NAMESPACES) and the sharedisExecutableUrlscheme check that close both bypasses.One note on the lockfile: the existing docs lockfile resolves packages through the
ms-feed-*.pkgs.visualstudio.com1ES mirror, but that host is not reachable from this environment, so the new entry points atregistry.npmjs.orgwith the official sha512 integrity. npm handles the mixed hosts fine, but if you would rather keep the file uniform, regenerating the entry from the mirror will swap it back.🤖 Generated with Claude Code
https://claude.ai/code/session_01ELjK1ZcXrvTuv59mkf4d9S
Generated by Claude Code