Merge pull request #169 from artiz/claude/codeql-findings

ci: least-privilege GITHUB_TOKEN; serve UI renders pictures from the …

Author: artiz

.github/workflows/ci.yml

@@ -15,6 +15,12 @@ on:
         required: false
         default: ""
 
+# Least privilege for GITHUB_TOKEN: every job here only reads the checkout.
+# The one exception — `publish`, which pushes the release commit and tag —
+# raises it to `contents: write` on the job itself.
+permissions:
+  contents: read
+
 # Cancel superseded PR runs, but never interrupt a master run (it may publish).
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}

.github/workflows/deps-update.yml

@@ -14,9 +14,9 @@ on:
     - cron: "17 4 * * 1" # Mondays 04:17 UTC
   workflow_dispatch:
 
+# Least privilege by default; the `cargo-update` job raises what it needs.
 permissions:
-  contents: write # push the deps/cargo-update branch
-  pull-requests: write # open/refresh the update PR
+  contents: read
 
 jobs:
   # Weekly known-CVE scan of the committed lockfiles. Runs unconditionally
@@ -68,6 +68,9 @@ jobs:
 
   cargo-update:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # push the deps/cargo-update branch
+      pull-requests: write # open/refresh the update PR
     steps:
       - uses: actions/checkout@v7
         with:

.github/workflows/npm-publish.yml

@@ -42,6 +42,12 @@ on:
         type: boolean
         default: false
 
+# Least privilege for GITHUB_TOKEN: publishing goes to npm with NPM_TOKEN, so
+# the token only needs the checkout. `publish-cuda`, which uploads binaries to
+# a GitHub release, raises it to `contents: write` on the job itself.
+permissions:
+  contents: read
+
 concurrency:
   group: npm-publish-${{ inputs.tag || github.ref }}
   cancel-in-progress: false

crates/docling-serve/src/index.html

@@ -170,7 +170,12 @@ <h2>Examples</h2>
     if (start === -1) break;
     const marker = text.indexOf(';base64,', start);
     const subtype = marker === -1 ? '' : text.slice(start + 11, marker);
-    if (marker === -1 || subtype.length > 20 || !/^[a-z.+-]+$/.test(subtype)) {
+    // `svg+xml` is excluded on purpose: an SVG is markup, and while a browser
+    // does not run scripts in one loaded through <img src>, the pipeline never
+    // emits SVG pictures anyway (crops are PNG) — so a data:image/svg+xml run
+    // in the output is not ours to render.
+    if (marker === -1 || subtype.length > 20 || !/^[a-z.+-]+$/.test(subtype)
+        || subtype === 'svg+xml') {
       from = start + 11;
       continue;
     }
@@ -263,18 +268,28 @@ <h2>Examples</h2>
       return;
     }
     // Stream the body into the panel as it arrives (Markdown streams page by page).
+    // The text is accumulated in a variable and mirrored into the panel, never
+    // read back out of it: re-reading a multi-megabyte textContent per chunk is
+    // quadratic, and the gallery must render from the response we received
+    // rather than from DOM text (CodeQL js/xss-through-dom).
     out.textContent = '';
+    let body = '';
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
     for (;;) {
       const { done, value } = await reader.read();
       if (done) break;
-      out.textContent += decoder.decode(value, { stream: true });
+      const chunk = decoder.decode(value, { stream: true });
+      body += chunk;
+      out.textContent += chunk;
     }
     if (to === 'json' || to === 'chunks') {
-      try { out.textContent = JSON.stringify(JSON.parse(out.textContent), null, 2); } catch {}
+      try {
+        body = JSON.stringify(JSON.parse(body), null, 2);
+        out.textContent = body;
+      } catch {}
     }
-    try { renderImages(out.textContent, to); } catch (e) { console.error('gallery:', e); }
+    try { renderImages(body, to); } catch (e) { console.error('gallery:', e); }
   } catch (e) {
     out.classList.add('err');
     out.textContent = String(e);