Hardening pass: input validation, origin checks, and default-safe field behaviour — main (v3-alpha) - #739

Merged

qroll merged 23 commits into

LifeSG:mainfrom

shengxi-gt:clean/MOL-22453-main

Sep 22, 2026

Commits on Sep 18, 2026

[MOL-22453][SX] CI: harden GitHub Actions workflow against injection via env vars
Chen Shengxi (Dave)
committed
6426785
[MOL-22453][SX] Add RegexHelper: shared regex parsing + safe cap, update all callers
Chen Shengxi (Dave)
committed
fe96edf
[MOL-22453][SX] sanitize-html: restrict allowedAttributes to safe defaults (no wildcard)
Chen Shengxi (Dave)
committed
0cfe2d6
[MOL-22453][SX] ButtonField: restrict href to http/https/mailto/tel schemes only
Chen Shengxi (Dave)
committed
bc40ced
[MOL-22453][SX] Iframe: validate postMessage origin against iframe src (default on)
Chen Shengxi (Dave)
committed
35af1eb
[MOL-22453][SX] LocationField: escape search query before use in RegExp (prevent ReDoS)
Chen Shengxi (Dave)
committed
ba52346
[MOL-22453][SX] StyleHelper: strip @import and url() from schema-authored cssText
Chen Shengxi (Dave)
committed
bb585f7
[MOL-22453][SX] ImageUpload: fix matches rule incorrectly blocking valid file submissions
Chen Shengxi (Dave)
committed
69f1ddf
[MOL-22453][SX] Docker: bind port explicitly instead of host networking
Chen Shengxi (Dave)
committed
6b159da
[MOL-22453][SX] FilterCheckbox: omit sanitizeOptions (equivalent to default)
Chen Shengxi (Dave)
committed
531d1f8
[MOL-22453][SX] yup matches: add comment explaining non-string guard
Chen Shengxi (Dave)
committed
fc2318e
[MOL-22453][SX] RegexHelper: rename parseMatchesPattern to compile
Chen Shengxi (Dave)
committed
6ba9491
[MOL-22453][SX] RegexHelper: rename MAX_SAFE_PATTERN_INPUT_LENGTH to MAX_MATCHES_INPUT_LENGTH, bump to 1000
Chen Shengxi (Dave)
committed
50b78d8
[MOL-22453][SX] yup matches: also pass empty string
Chen Shengxi (Dave)
committed
ba8a2fa
[MOL-22453][SX] LocationField: use vm.runInNewContext to prevent CI hang on ReDoS regression
Chen Shengxi (Dave)
committed
7cbf0e5

Commits on Sep 21, 2026

[MOL-22453][SX] Stories: document url()/import stripping in locationModalStyles and imageReviewModalStyles
Chen Shengxi (Dave)
committed
e4329bb
[MOL-22453][SX] yup: restore missing buildWhenDependencyMap (accidentally dropped in fe96edf0)
Chen Shengxi (Dave)
committed
4ad599b
[MOL-22453][SX] Stories: fix curly quotes (U+201C/U+201D) in locationModalStyles argType
Chen Shengxi (Dave)
committed
c034891
[MOL-22453][SX] Update src/__tests__/components/fields/location-field/location-modal/location-search/helper.spec.ts

shengxi-gt
and
qroll
authored
2414fcc
[MOL-22453][SX] ImageUpload: use repeat(1000) to exceed MAX_MATCHES_INPUT_LENGTH guard in hang test
Chen Shengxi (Dave)
committed
ef6c651
[MOL-22453][SX] Tests: fix catastrophic-regex test values to exceed MAX_MATCHES_INPUT_LENGTH guard
Chen Shengxi (Dave)
committed
bd83d8a
[MOL-22453][SX] Tests: fix masked-field repeat(600) to exceed MAX_MATCHES_INPUT_LENGTH guard
Chen Shengxi (Dave)
committed
1d3311a
[MOL-22453][SX] Tests: fix masked-field hang tests and max-validation values
Chen Shengxi (Dave)
committed
bd40b47

Navigation Menu

Hardening pass: input validation, origin checks, and default-safe field behaviour — main (v3-alpha) - #739

Hardening pass: input validation, origin checks, and default-safe field behaviour — main (v3-alpha)#739
qroll merged 23 commits into
LifeSG:mainfrom
shengxi-gt:clean/MOL-22453-main

Commits on Sep 18, 2026

[MOL-22453][SX] CI: harden GitHub Actions workflow against injection via env vars

[MOL-22453][SX] Add RegexHelper: shared regex parsing + safe cap, update all callers

[MOL-22453][SX] sanitize-html: restrict allowedAttributes to safe defaults (no wildcard)

[MOL-22453][SX] ButtonField: restrict href to http/https/mailto/tel schemes only

[MOL-22453][SX] Iframe: validate postMessage origin against iframe src (default on)

[MOL-22453][SX] LocationField: escape search query before use in RegExp (prevent ReDoS)

[MOL-22453][SX] StyleHelper: strip @import and url() from schema-authored cssText

[MOL-22453][SX] ImageUpload: fix matches rule incorrectly blocking valid file submissions

[MOL-22453][SX] Docker: bind port explicitly instead of host networking

[MOL-22453][SX] FilterCheckbox: omit sanitizeOptions (equivalent to default)

[MOL-22453][SX] yup matches: add comment explaining non-string guard

[MOL-22453][SX] RegexHelper: rename parseMatchesPattern to compile

[MOL-22453][SX] RegexHelper: rename MAX_SAFE_PATTERN_INPUT_LENGTH to MAX_MATCHES_INPUT_LENGTH, bump to 1000

[MOL-22453][SX] yup matches: also pass empty string

[MOL-22453][SX] LocationField: use vm.runInNewContext to prevent CI hang on ReDoS regression

Commits on Sep 21, 2026

[MOL-22453][SX] Stories: document url()/import stripping in locationModalStyles and imageReviewModalStyles

[MOL-22453][SX] yup: restore missing buildWhenDependencyMap (accidentally dropped in fe96edf0)

[MOL-22453][SX] Stories: fix curly quotes (U+201C/U+201D) in locationModalStyles argType

[MOL-22453][SX] Update src/tests/components/fields/location-field/location-modal/location-search/helper.spec.ts

[MOL-22453][SX] ImageUpload: use repeat(1000) to exceed MAX_MATCHES_INPUT_LENGTH guard in hang test

[MOL-22453][SX] Tests: fix catastrophic-regex test values to exceed MAX_MATCHES_INPUT_LENGTH guard

[MOL-22453][SX] Tests: fix masked-field repeat(600) to exceed MAX_MATCHES_INPUT_LENGTH guard

[MOL-22453][SX] Tests: fix masked-field hang tests and max-validation values