diff --git a/browse/src/write-commands.ts b/browse/src/write-commands.ts index 73896ba392..15ce79616c 100644 --- a/browse/src/write-commands.ts +++ b/browse/src/write-commands.ts @@ -247,11 +247,11 @@ export async function handleWriteCommand( if (!filePath) throw new Error('Usage: browse load-html [--wait-until load|domcontentloaded|networkidle] [--tab-id ] | load-html --from-file [--tab-id ]'); // Extension allowlist - const ALLOWED_EXT = ['.html', '.htm', '.xhtml', '.svg']; + const ALLOWED_EXT = ['.html', '.htm', '.xhtml']; const ext = path.extname(filePath).toLowerCase(); if (!ALLOWED_EXT.includes(ext)) { throw new Error( - `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml/.svg, got ${ext || '(no extension)'}. Rename the file if it's really HTML.` + `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml, got ${ext || '(no extension)'}. Rename the file if it's really HTML.` ); } diff --git a/browse/test/commands.test.ts b/browse/test/commands.test.ts index b3870c0ccf..5916c35dd1 100644 --- a/browse/test/commands.test.ts +++ b/browse/test/commands.test.ts @@ -2143,6 +2143,19 @@ describe('load-html', () => { } }); + test('load-html rejects .svg files', async () => { + const svgPath = path.join(tmpDir, `load-html-test-${Date.now()}.svg`); + fs.writeFileSync(svgPath, 'hi'); + try { + await handleWriteCommand('load-html', [svgPath], bm); + expect(true).toBe(false); + } catch (err: any) { + expect(err.message).toMatch(/does not appear to be HTML/); + } finally { + try { fs.unlinkSync(svgPath); } catch {} + } + }); + test('load-html rejects file outside safe dirs', async () => { try { await handleWriteCommand('load-html', ['/etc/passwd.html'], bm);