fix(site): replace ansi-to-html in the log viewer - #27206
Merged
aslilac merged 3 commits intoJul 14, 2026
Conversation
ansi-to-html 0.7.2 (unmaintained) has a ReDoS in its SGR regex (Cure53 CDM-02-004 / SEC-266). The agent log viewer is the only consumer. Swap it for fancy-ansi, which parses in linear time and escapes untrusted markup by default. Also simplify the carriage-return progress-bar handling from a regex split to lastIndexOf/slice.
…p useMemo Move the ANSI/ReDoS/carriage-return coverage into the vitest suite instead of a Storybook story, since it is purely functional. Also drop the useMemo around the carriage-return slice.
…tory Keep the visual AnsiFormatting story for presentation while the functional assertions live in the vitest suite.
jakehwll
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the unmaintained
ansi-to-html(last released ~5 years ago) withfancy-ansiin the agent logviewer, the library's only consumer.
fancy-ansiparses in linear time andescapes untrusted markup by default, resolving the ReDoS reported in Cure53
CDM-02-004 (SEC-266).
While here, the carriage-return progress-bar handling is simplified from a
regex
splittolastIndexOf/slice, and the manualdangerouslySetInnerHTMLis dropped in favor of the library's
<AnsiHtml>component.The existing XSS-escaping test still passes, and a new Storybook story exercises
ANSI colors, carriage-return redraws, escaped markup, and the reported payload.
Implementation plan
Context
Cure53 CDM-02-004 (SEC-266, LOW): ReDoS in
ansi-to-html@0.7.2.Findings
AgentLogLine.tsx(agent/startup logs). It was the onlyconsumer of
ansi-to-html.(
WorkspaceBuildLogs->Logs) renders output as plain text with no ANSIconversion, so the real surface is agent logs.
escapeXML: truemeant this was DoS-only (consistent with LOW).line.output.split(/\r/g).pop()bounded input but did not prevent the hang.Decision
Two independent workstreams, one PR at a time:
ansi-to-html->fancy-ansi.ghostty-webparser prototype as a proving ground for the planned xterm.js ->
ghostty-web migration.
Verification
fancy-ansi.toHtmlon the reported payload: linear time (50k chars ~0.1ms).Generated by Coder Agents on behalf of @aslilac.