fix(p1): XSS escaping, VALID_LICENSES mismatch, and license re-validation - #58
Merged
Merged
Conversation
…tion Three related security/correctness fixes: 1. XSS: Apply html.escape() to all user-supplied metadata values (author, license, copyright, source) when building raw HTML for caption placement. Previously, values containing < > & " characters could inject arbitrary HTML into the rendered output. 2. VALID_LICENSES mismatch: Add GPL-2.0, LGPL-2.1, LGPL-3.0, AGPL-3.0, and BSD-2-Clause to VALID_LICENSES. These licenses had entries in LICENSE_URLS (so URL linking was configured) but were absent from VALID_LICENSES, causing them to always trigger "unrecognized license" warnings regardless of whether strict_check was enabled. 3. License re-validation: In check_all_figures_have_license(), the license value stored on a figure node has already been translated and formatted for display. Reverse-translate it via untranslate_license() before comparing to VALID_LICENSES, otherwise the summaries check incorrectly flags every figure as having an unrecognized license. https://claude.ai/code/session_01VHh4HTkZeiMxwZyGMEBypX
douden
added a commit
that referenced
this pull request
Mar 16, 2026
* style(p3): update module docstring, remove spurious f-strings, fix indentation and blank lines (#60) Code style clean-ups with no behaviour change: - Module docstring: expanded to reflect all current features (copyright, source, multiple placements, page defaults, BibTeX integration, figure variants, i18n) instead of only listing the original three fields. - f-strings without interpolation: two logger.warning() calls used f-string prefixes on every string literal despite containing no variables. Converted to plain string concatenation. - Indentation: location= keyword argument in the no-image warning was indented one level too shallow (aligned with the string literal instead of the opening parenthesis). Fixed to match the rest of the codebase. - PEP 8 blank lines: added the missing second blank line between _parse_bib_entry / _load_user_configured_bib_files and between untranslate_license / clear_page_defaults (top-level functions require two blank lines between them). - Typo in comment: "MysST NB" -> "MyST-NB" in setup(). https://claude.ai/code/session_01VHh4HTkZeiMxwZyGMEBypX Co-authored-by: Claude <noreply@anthropic.com> * fix(p2): guard HTMLTranslator against double-patching, pin dependency versions (#59) Two independent improvements: 1. Patch guard: _patch_html_translator() now checks for a sentinel attribute (_sphinx_metadata_figure_patched) before applying the monkey-patch. Previously, each call to setup() in the same Python process (common in multi-run test suites) would re-wrap the already- wrapped methods, causing each caption visit to inject license_html multiple times. 2. Dependency version constraints: sphinx and myst-nb now have minimum version pins (>=5.0 and >=0.17 respectively) to prevent silent breakage when installed alongside incompatible older versions. Also adds [project.urls] section so PyPI shows Homepage, Documentation, and Bug Tracker links. https://claude.ai/code/session_01VHh4HTkZeiMxwZyGMEBypX Co-authored-by: Claude <noreply@anthropic.com> * fix(p1): XSS escaping, VALID_LICENSES mismatch, and license re-validation (#58) Three related security/correctness fixes: 1. XSS: Apply html.escape() to all user-supplied metadata values (author, license, copyright, source) when building raw HTML for caption placement. Previously, values containing < > & " characters could inject arbitrary HTML into the rendered output. 2. VALID_LICENSES mismatch: Add GPL-2.0, LGPL-2.1, LGPL-3.0, AGPL-3.0, and BSD-2-Clause to VALID_LICENSES. These licenses had entries in LICENSE_URLS (so URL linking was configured) but were absent from VALID_LICENSES, causing them to always trigger "unrecognized license" warnings regardless of whether strict_check was enabled. 3. License re-validation: In check_all_figures_have_license(), the license value stored on a figure node has already been translated and formatted for display. Reverse-translate it via untranslate_license() before comparing to VALID_LICENSES, otherwise the summaries check incorrectly flags every figure as having an unrecognized license. https://claude.ai/code/session_01VHh4HTkZeiMxwZyGMEBypX Co-authored-by: Claude <noreply@anthropic.com> * fix: initialize generated_keys set in pre_generate_bib_entries (#57) `generated_keys` was referenced before assignment, causing a NameError at runtime whenever `generate_bib: true` was set in configuration. Added `generated_keys = set()` before the loop and populated it when a new entry is appended, so duplicate bib keys within the same scan are correctly skipped. https://claude.ai/code/session_01VHh4HTkZeiMxwZyGMEBypX Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: Kwangjin Lee <70512257+lkdmc@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three related security/correctness fixes:
XSS: Apply html.escape() to all user-supplied metadata values (author, license, copyright, source) when building raw HTML for caption placement. Previously, values containing < > & " characters could inject arbitrary HTML into the rendered output.
VALID_LICENSES mismatch: Add GPL-2.0, LGPL-2.1, LGPL-3.0, AGPL-3.0, and BSD-2-Clause to VALID_LICENSES. These licenses had entries in LICENSE_URLS (so URL linking was configured) but were absent from VALID_LICENSES, causing them to always trigger "unrecognized license" warnings regardless of whether strict_check was enabled.
License re-validation: In check_all_figures_have_license(), the license value stored on a figure node has already been translated and formatted for display. Reverse-translate it via untranslate_license() before comparing to VALID_LICENSES, otherwise the summaries check incorrectly flags every figure as having an unrecognized license.