Google: code injection

# Code injection in schema-dts-gen: `rdfs:comment` literals are emitted as raw JSDoc, so a `*/` in the comment breaks out and adds top-level statements > [!IMPORTANT] > The schema-dts package is not affected. It is generated from the schema.org ontology over HTTPS and published manually. Users of schema-dts need take no action. ## Report metadata | Field | Value | | --- | --- | | Package | `schema-dts-gen` (generator package inside the `google/schema-dts` monorepo; recorded package identifier `pkg:github/google/schema-dts` — no ecosystem-specific purl was recorded) | | Repository | https://github.com/google/schema-dts | | Component | `withComments()` (sink) and `parseComment()` in `packages/schema-dts-gen/src/ts/util/comments.ts` | | Vulnerability class | Code injection into generated source via comment-delimiter breakout | | CWE | [CWE-94](https://cwe.mitre.org/data/definitions/94.html) | | Severity (reporter assessment) | High | | Verified against | `b9ef0d03e1b78677c17aa51a6c0b7b28a4b7a60c` (code read) and `6ff6f6fcdaf736f30a18a6ad9546de7474a0cbb8` (reproduction; `packages/schema-dts-gen/package.json` declares version 2.0.0) | | Affected versions | 2.0.0 / current `main`. Earlier releases **not assessed** | | API surface | Public documented API — `schema-dts-gen --ontology=<https URL>` and `--file`; the generator path `WriteDeclarations` is also exported from `src/index.ts:18` | | Affected in default configuration | No — the default input is the schema.org ontology fetched over HTTPS, which is not affected. The issue requires a custom `--ontology` URL or `--file` | | CVE / GHSA | None assigned (unknown) | | Existing upstream report / advisory | Unknown — none recorded | ## Summary `withComments()` copies an ontology's `rdfs:comment` literal into a TypeScript *synthetic* comment node (`SyntaxKind.MultiLineCommentTrivia`) without escaping the comment terminator. `parseComment()` (`comments.ts:65-99`) parses the markdown/HTML of the comment and assembles JSDoc text as `* <line> ` (or `*\n * ...`); its only text-replacement helper (`comments.ts:297-305`) handles escaped newline and unicode sequences and never escapes `*/`. When the TypeScript printer serializes the node, a `*/` inside the ontology comment closes the JSDoc early, and whatever follows it in the literal lands in the generated file as ordinary source. For a consuming application, the shape of the bug is: a data-only RDF input becomes source code. Anyone who controls or can modify the ontology the generator reads — a third-party ontology publisher for `--ontology`, or whoever supplies the file for `--file` — can add arbitrary top-level TypeScript statements to the generated `.ts` module. Custom ontology input is an explicitly documented use case (`packages/schema-dts-gen/README.md:29-34`), and the repository's own build pattern redirects generator output into a compiled package module (`packages/schema-dts/package.json:52-54` and `:18`). Other ontology-derived values reaching the generated file are handled safely, which is the clearest evidence that this path is an escaping gap rather than intended behaviour: - ontology-derived class names -> sanitized in `ts/util/names.ts` (safe) - property and type values -> emitted through TypeScript factory string/identifier nodes, which quote and sanitize (safe) - escaped newline / unicode sequences inside comment text -> handled by the text helper, `comments.ts:297-305` (safe) - `rdfs:comment` text -> **inserted as raw `MultiLineCommentTrivia` with no delimiter escaping, `comments.ts:33-48` (unsafe)** ## Impact An attacker who controls an ontology consumed by the generator can turn data-only RDF comments into arbitrary JavaScript inside the generated module. If the consuming application compiles that module and loads, imports, or publishes it, the injected code executes with that application's privileges — in practice, on a developer machine or in a CI/build job, and downstream in

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-94

• github.com/google/schema-dts/security/advisories/GHSA-c4f4-pq98-f2p2
• github.com/google/schema-dts