Security: fix CSS injection, javascript: URL injection, and SVG script injection

[Copilot]

Three injection vulnerabilities in the static site generator pipeline allow an attacker with write access to recipients/*.json or scripts/generated_qr/*.svg to inject malicious content into generated HTML pages.

Exploit 1 — CSS injection via accent/muted fields

accent and muted values were interpolated directly into <style> blocks with no validation:

# Before — injects arbitrary CSS rules
s = re.sub(r'(--accent:\s*)[^;]+;', rf'\1{str(data["accent"])};', s)

A payload like "accent": "red; } body { display:none }" breaks out of the :root block. CSS url() functions can also be used for data exfiltration.

Fix: Added _CSS_COLOR_RE allowlist (hex, rgb()/rgba(), hsl()/hsla(), named colors) and _is_safe_css_color() guard — invalid values are silently ignored, leaving the template default.

Exploit 2 — javascript:/data: URL injection in gift hrefs

href values were only HTML-escaped, not scheme-checked. "href": "javascript:alert(1)" produces a working XSS link that executes on click.

Fix: Added _is_safe_href() that allowlists http://, https://, and mailto:. Unsafe hrefs are downgraded to plain text (visible label preserved).

Exploit 3 — Inline SVG <script> and event handler injection

sanitize_svg_for_html() only stripped XML prologs and DOCTYPE. Since SVGs are parsed as part of the HTML document when inlined, any <script> block or on* attribute in a committed .svg file executes in the page context.

Fix: sanitize_svg_for_html() now strips <script> blocks (closing tag uses [^>]* per CodeQL py/bad-tag-filter), self-closing <script/>, on* event-handler attributes, and <style> blocks.

Tests

47 new tests in tests/test_security.py covering allowlist helpers, each injection class, and clean-passthrough cases.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	simplewish	ae4a6f0	Apr 07 2026, 03:31 PM