fix: remove empty anchor tags from GHSA vulnerability details #4431

Vasuk12 · 2025-11-29T20:36:08Z

Fixes issue #4237
where empty anchor tags like were appearing in GHSA vulnerability details fields.

Add _sanitize_anchor_tags() function in osv/sources.py
Apply sanitization in parse_vulnerability_from_dict()
Add anchor tag removal in markdown() template filter
Update frontend_emulator.py to use parse_vulnerability_from_dict()

Fixes issue where empty anchor tags like <a name="executive-summary"></a> were appearing in GHSA vulnerability details fields. These anchor tags are used for navigation in the original GHSA advisories but create empty links when displayed in OSV records. This affects 51 GHSA records, including NuGet packages. The fix is implemented at two layers for defense in depth: 1. Data layer (osv/sources.py): - Add _sanitize_anchor_tags() function to remove empty anchor tags with name attributes using regex pattern matching - Apply sanitization in parse_vulnerability_from_dict() to clean the details field during vulnerability parsing - Ensures anchor tags are removed when GHSA JSON files are imported 2. Display layer (gcp/website/frontend_handlers.py): - Add _ANCHOR_TAG_REPLACER regex pattern for anchor tag removal - Apply sanitization in markdown() template filter during rendering - Provides fallback protection if any anchor tags slip through 3. Emulator update (gcp/website/frontend_emulator.py): - Update to use parse_vulnerability_from_dict() instead of direct json_format.ParseDict() to ensure sanitization is applied during local testing Testing: - Verified fix removes all 7 anchor tags from GHSA-hh2w-p6rv-4g7w test case - Tested with various anchor tag formats (empty, self-closing, with attributes) - Confirmed regular links and anchor tags with content are preserved - Local testing performed using direct function tests and file parsing (gcloud emulator setup unavailable due to permission issues with ~/.config/gcloud directory ownership) Signed-off-by: Vasu <[email protected]>

another-rex

Couple of issues here:

This should only be updating the frontend, we shouldn't touch the records we are importing.
I was hoping that we could keep the anchor tags if possible, but I'm not sure that's possible without editing the markdown library itself, so happy to stick with the regex replacement if it's not possible.

Signed-off-by: Vasu <[email protected]>

Vasuk12 · 2025-12-01T04:21:56Z

Couple of issues here:

This should only be updating the frontend, we shouldn't touch the records we are importing.

I was hoping that we could keep the anchor tags if possible, but I'm not sure that's possible without editing the markdown library itself, so happy to stick with the regex replacement if it's not possible.

The latest commit resolves the issue of mutation of imported records
The regex element removal is working as intended but if you would like to keep the anchor tags we could add CSS rules to hide them visually while keeping them? I am not sure about this but would love to hear what you think about this!

osv/sources.py

another-rex · 2025-12-02T03:45:26Z

/gcbrun

another-rex

I'm not sure having it deleted before rendering vs adding a css rule would change much here. Let's stick with this for now.

What is the frontend emulator change for?

gcp/website/frontend_handlers.py

Vasuk12 · 2025-12-02T04:24:10Z

I'm not sure having it deleted before rendering vs adding a css rule would change much here. Let's stick with this for now.

What is the frontend emulator change for?

Okay.
Oh thats not related to Anchor tag.The frontend_emulator.py change was originally to include anchor tag sanitization via parse_vulnerability_from_dict(). Since we removed sanitization from that function, the emulator change is not needed anymore. Sorry about that I have reverted it back. I thought we could keep it as a code improvement as this includes some schema validation as well.

Fixes google#4237 Signed-off-by: Vasu <[email protected]>

Signed-off-by: Vasu <[email protected]>

another-rex · 2025-12-02T04:38:05Z

I see, I don't mind keeping it, just wanted to know what the functional difference is. Feel free to add it back in or not.

another-rex · 2025-12-02T04:38:18Z

/gcbrun

another-rex · 2025-12-02T04:50:21Z

Seems like there's a linting error for too long line. I think it's fine to add an exception for that, since we want the regex on one line:

# pylint: disable=line-too-long

You should be able to run make lint to check locally as well.

Vasuk12 · 2025-12-02T04:54:40Z

I see, I don't mind keeping it, just wanted to know what the functional difference is. Feel free to add it back in or not.

oh i will add it back then :). Umm i saw that for the function parse_vulnerability_from_dict() there are no unit tests although it is tested indirectly through integration tests. I could implement a unit test for this particular function or is not needed?

Vasuk12 · 2025-12-02T05:13:11Z

Seems like there's a linting error for too long line. I think it's fine to add an exception for that, since we want the regex on one line:
# pylint: disable=line-too-long
You should be able to run make lint to check locally as well.

I ran 'make lint' and pylint disable comment is working but there is another error where there is a unused import in frontend_emulator.py at line 18 'from google.protobuf import json_format'. Should I remove this?

another-rex · 2025-12-02T08:04:15Z

Feel free to add the unit tests, that would be great!

I ran 'make lint' and pylint disable comment is working but there is another error where there is a unused import in frontend_emulator.py at line 18 'from google.protobuf import json_format'. Should I remove this?

Huh, I'm surprised it doesn't show up in the CI pylint. I would not change that for now, and let's see if CI passes.

Added inline pylint disable comment for line-too-long warning on the anchor tag regex pattern in frontend_handlers.py. Signed-off-by: Vasu Khare <[email protected]>

Vasuk12 · 2025-12-02T09:27:03Z

Feel free to add the unit tests, that would be great!

I ran 'make lint' and pylint disable comment is working but there is another error where there is a unused import in frontend_emulator.py at line 18 'from google.protobuf import json_format'. Should I remove this?

Huh, I'm surprised it doesn't show up in the CI pylint. I would not change that for now, and let's see if CI passes.

Added the pylint comment in this commit. Let me know if lint check is working now. Should I implement the unit tests in this PR only or would you like me to create another PR? Also are there any specific functions you have in mind other than 'parse_vulnerability_from_dict()'.

another-rex · 2025-12-03T00:44:48Z

Please do so in another PR :)

/gcbrun

Vasuk12 mentioned this pull request Nov 29, 2025

Some NuGet records contain anchor tags #4237

Open

google deleted a comment from google-cla bot Nov 30, 2025

another-rex reviewed Nov 30, 2025

View reviewed changes

fix: remove data layer anchor tag sanitization, keep frontend-only fix

2bcecde

Signed-off-by: Vasu <[email protected]>

ashmod suggested changes Dec 1, 2025

View reviewed changes

osv/sources.py Outdated Show resolved Hide resolved

osv/sources.py Outdated Show resolved Hide resolved

another-rex reviewed Dec 2, 2025

View reviewed changes

gcp/website/frontend_handlers.py Show resolved Hide resolved

Vasuk12 force-pushed the fix/remove-empty-anchor-tags branch from c38f285 to 9037093 Compare December 2, 2025 04:23

Vasuk12 force-pushed the fix/remove-empty-anchor-tags branch 2 times, most recently from 015c0d6 to 38997f7 Compare December 2, 2025 04:30

Vasuk12 added 2 commits December 2, 2025 04:33

fix: remove empty anchor tags from rendered markdown

66d2251

Fixes google#4237 Signed-off-by: Vasu <[email protected]>

fix: remove empty anchor tags from rendered markdown

e33a424

Fixes google#4237 Signed-off-by: Vasu <[email protected]>

Vasuk12 force-pushed the fix/remove-empty-anchor-tags branch from 38997f7 to e33a424 Compare December 2, 2025 04:33

fix: update comment with issue number

3ff7db2

Signed-off-by: Vasu <[email protected]>

another-rex previously approved these changes Dec 2, 2025

View reviewed changes

fix: add pylint disable for long regex line

175dc25

Added inline pylint disable comment for line-too-long warning on the anchor tag regex pattern in frontend_handlers.py. Signed-off-by: Vasu Khare <[email protected]>

Vasuk12 dismissed another-rex’s stale review via 175dc25 December 2, 2025 09:15

another-rex approved these changes Dec 3, 2025

View reviewed changes

Vasuk12 mentioned this pull request Dec 4, 2025

test: add unit tests for markdown filter #4460

Open

fix: remove empty anchor tags from GHSA vulnerability details #4431

Are you sure you want to change the base?

fix: remove empty anchor tags from GHSA vulnerability details #4431

Conversation

Vasuk12 commented Nov 29, 2025

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

Vasuk12 commented Dec 1, 2025

Uh oh!

Uh oh!

Uh oh!

another-rex commented Dec 2, 2025

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Vasuk12 commented Dec 2, 2025

Uh oh!

another-rex commented Dec 2, 2025

Uh oh!

another-rex commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

another-rex commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Vasuk12 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Vasuk12 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

another-rex commented Dec 2, 2025

Uh oh!

Vasuk12 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

another-rex commented Dec 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

another-rex commented Dec 2, 2025 •

edited

Loading

another-rex commented Dec 2, 2025 •

edited

Loading

Vasuk12 commented Dec 2, 2025 •

edited

Loading

Vasuk12 commented Dec 2, 2025 •

edited

Loading

Vasuk12 commented Dec 2, 2025 •

edited

Loading