Fix/form custom css html encoding #21989
Conversation
Replace sanitize-html with regex-based sanitization for CSS to preserve CSS syntax (>, <, &) while preventing XSS attacks. This fixes the issue where CSS selectors with > were encoded as > breaking the selectors. - Remove closing style tags to prevent breaking out of <style> tag - Remove script tags (case-insensitive, handles various formats) - Remove any other HTML tags - Preserve CSS syntax characters Fixes n8n-io#21959
refactoring
n8n-assistant
bot
added
community
|
Hey @rishiraj-58, Thank you for your contribution. We appreciate the time and effort you’ve taken to submit this pull request. Before we can proceed, please ensure the following: Regarding new nodes: If your node integrates with an AI service that you own or represent, please email [email protected] and we will be happy to discuss the best approach. About review timelines: Thank you again for contributing to n8n. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 1 file
Prompt for AI agents (all 2 issues)
Understand the root cause of the following 2 issues and fix them.
<file name="packages/nodes-base/nodes/Form/utils/utils.ts">
<violation number="1" location="packages/nodes-base/nodes/Form/utils/utils.ts:128">
Rule violated: **Tests**
Community PR Guidelines §2 require PRs to include tests; this rewrite of the sanitizeCustomCss security logic ships without any automated unit or workflow tests verifying the new sanitization behavior.</violation>
<violation number="2" location="packages/nodes-base/nodes/Form/utils/utils.ts:135">
Entity-encoded closing tags (e.g. `&lt;/style&gt;`) are no longer stripped, letting attackers escape the `<style>` block and inject arbitrary HTML/JS when forms render custom CSS.</violation>
</file>
Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR
| // Remove script tags (case-insensitive, handles various formats) | ||
| .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '') | ||
| // Remove any other HTML tags | ||
| .replace(/<[^>]*>/g, '') |
There was a problem hiding this comment.
Entity-encoded closing tags (e.g. </style>) are no longer stripped, letting attackers escape the <style> block and inject arbitrary HTML/JS when forms render custom CSS.
Prompt for AI agents
Address the following comment on packages/nodes-base/nodes/Form/utils/utils.ts at line 135:
<comment>Entity-encoded closing tags (e.g. `&lt;/style&gt;`) are no longer stripped, letting attackers escape the `<style>` block and inject arbitrary HTML/JS when forms render custom CSS.</comment>
<file context>
@@ -123,13 +123,18 @@ export const prepareFormFields = (context: IWebhookFunctions, fields: FormFields
+ // Remove script tags (case-insensitive, handles various formats)
+ .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+ // Remove any other HTML tags
+ .replace(/<[^>]*>/g, '')
+ .trim()
+ );
</file context>
| }); | ||
| // Remove potentially dangerous HTML/script tags and prevent style tag breakout | ||
| // This preserves CSS syntax (>, <, &, etc.) while preventing XSS attacks | ||
| return ( |
There was a problem hiding this comment.
Rule violated: Tests
Community PR Guidelines §2 require PRs to include tests; this rewrite of the sanitizeCustomCss security logic ships without any automated unit or workflow tests verifying the new sanitization behavior.
Prompt for AI agents
Address the following comment on packages/nodes-base/nodes/Form/utils/utils.ts at line 128:
<comment>Community PR Guidelines §2 require PRs to include tests; this rewrite of the sanitizeCustomCss security logic ships without any automated unit or workflow tests verifying the new sanitization behavior.</comment>
<file context>
@@ -123,13 +123,18 @@ export const prepareFormFields = (context: IWebhookFunctions, fields: FormFields
- });
+ // Remove potentially dangerous HTML/script tags and prevent style tag breakout
+ // This preserves CSS syntax (>, <, &, etc.) while preventing XSS attacks
+ return (
+ css
+ // Remove closing style tags to prevent breaking out of <style> tag
</file context>
1 participant
Summary
Fixes issue where custom CSS styling in the Form node gets HTML encoded (turning
>into>etc.), breaking CSS selectors. ThesanitizeCustomCssfunction was usingsanitize-htmlwhich HTML-encodes special characters, making CSS selectors like#n8n-form > div.form-header > pnon-functional.Changes:
sanitize-htmlwith regex-based sanitization for CSS>,<,&, etc.) while preventing XSS attacks</style>tags to prevent breaking out of style tagTesting:
>work correctly (e.g.,#n8n-form > div.form-header > p)>,<,&charactersRelated Linear tickets, Github issues, and Community forum posts
Fixes #21959
Review / Merge checklist
release/backport(if the PR is an urgent fix that needs to be backported)Note
Update CSS sanitization to strip HTML/script and closing style tags without HTML-encoding, preserving CSS selectors.
packages/nodes-base/nodes/Form/utils/utils.ts):sanitizeCustomCssto use regex-based sanitization instead ofsanitize-html.</style>,<script>blocks, and other HTML tags.>,<,&) to avoid breaking selectors.Written by Cursor Bugbot for commit 3194017. This will update automatically on new commits. Configure here.