Fix: Sanitize SVG to prevent Stored XSS (Fixes #5514)

[jeongbeannnn]

Summary

This PR fixes a Stored XSS vulnerability in the ADK web development UI that allows arbitrary JavaScript execution via malicious SVG artifacts (Issue #5514).

Changes

• Added _sanitize_svg_content() function to remove XSS vectors from SVG content
• Modified load_artifact() to sanitize SVG artifacts before returning to clients
• Removes dangerous elements: <foreignObject>, <script> tags, and event handler attributes
• Preserves legitimate SVG structure and valid attributes

Technical Details

Vulnerability

The vulnerability exists because the web dev UI uses Angular's bypassSecurityTrustHtml() to render SVG content without prior sanitization. An attacker can craft a malicious SVG artifact containing:

• <foreignObject> elements with embedded XHTML
• Event handlers like onerror, onload, onclick
• JavaScript URLs in attributes

When a developer views the artifact in the dev UI, the XSS payload executes with full access to the developer's credentials and session.

Fix Strategy

Server-side SVG sanitization using regex-based filtering:

1. Remove <foreignObject> elements completely
2. Remove <script> tags
3. Strip event handler attributes (onerror, onload, onclick, etc.)
4. Remove javascript: URLs
5. Preserve legitimate SVG structure and styling

Testing

• Added comprehensive unit tests in tests/unittests/cli/test_svg_sanitization.py
• 16 test cases covering:
  • foreignObject removal
  • script tag removal
  • Event handler removal (onload, onclick, onerror, onmouseover, etc.)
  • Valid SVG element preservation
  • SVG attribute preservation
  • JavaScript URL removal
  • Case-insensitive removal
  • Complex XSS payloads from issue Stored XSS via SVG foreignObject in ADK Web Dev UI #5514

Verification

• Docker verification: Successfully tested against multiple XSS payloads
  • foreignObject + onerror handler ✓
  • Direct <script> tags ✓
  • Event handlers ✓
  • Valid SVG rendering still works ✓

References

• GitHub Issue: Stored XSS via SVG foreignObject in ADK Web Dev UI #5514
• OWASP CWE-79: Improper Neutralization of Input During Web Page Generation
• Similar CVEs: CVE-2024-22420, CVE-2023-6152

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[rohityan]

Hi @jeongbeannnn , Thank you for your contribution! Please fix the failing tests.

[jeongbeannnn]

Hi @haranrk, I rebuilt this PR on the latest main branch after the web server refactor. The PR now contains one clean commit touching three files, and the merge conflict and accidental Desktop/... paths are gone.

The SVG sanitization now lives in api_server.py and is shared by both load_artifact() and load_artifact_version(). It uses an nh3 strict allowlist instead of regex filtering.

Local validation:

• SVG XSS regression tests: 6 passed
• Existing API server tests: 93 passed, 5 skipped
• Ruff, isort, pyink, license, and ADK compliance checks passed
• All currently visible GitHub checks completed without failures

Could you please review PR #5515 when you have a chance? Thank you!