[chicks-net]

Summary

/graph interpolated custom_title and every *_color query param directly into the generated SVG — a <style> block, fill/stroke attributes, and a <foreignObject><h1> title — with no validation or escaping.

A crafted color/bg_color/border_color/title_color/line/point/area_color or custom_title value can break out of its context and inject a <script> tag. Since the response is served as image/svg+xml with no CSP, that script executes when the URL is navigated to directly or embedded via <object>/<iframe>.

Verified with a PoC before this fix — e.g. color=fff} </style><script>alert(document.domain)</script><style>{ or custom_title=</h1><script>alert(1)</script> — the raw <script> tag survived unmodified in the response body.

Not previously reported anywhere I could find (no advisory on this repo, the upstream repo, or the fork). The sibling project this one is modeled after, github-readme-stats, had a similar bug class (CVE-2020-23986, fixed in PR #255).

Changes

• src/utils.ts: whitelist all color query params to hex-digit-only (sanitizeColor), falling back to the theme default on anything else. HTML-escape the resolved title (escapeHtml) before it reaches the SVG template.
• src/utils.ts / src/handlers.ts: add Content-Security-Policy: script-src 'none'; sandbox on SVG responses as defense in depth, so a future injection bug can't execute script even if it slips past validation.
• __test__/utils.test.ts: regression tests covering malicious color params (fall back to theme default) and a malicious custom_title (HTML-escaped, no raw <script> in output).

Test plan

• npx tsc --noEmit — clean
• npx jest — all tests pass except one pre-existing network-dependent test that needs a real GitHub TOKEN (fails identically on the base branch, unrelated to this change)
• Manual PoC re-run against the patched code confirms no raw <script> survives and malicious colors fall back to theme defaults

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens the /graph SVG output against injection by sanitizing user-controlled color query parameters, escaping the rendered title, and adding a restrictive CSP header as defense in depth.

Changes:

• Add sanitizeColor (hex-only) for all color query params and apply theme-default fallbacks.
• HTML-escape the resolved graph title before embedding it into the SVG <foreignObject>.
• Add Content-Security-Policy: script-src 'none'; sandbox for SVG responses and add regression tests for sanitization/escaping.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/utils.ts	Adds color sanitization, title escaping, and sets CSP header on SVG responses.
src/handlers.ts	Adds CSP header on the error SVG response path.
__test__/utils.test.ts	Adds regression tests for malicious color params and custom_title escaping.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.