Summary
In the security-guidance plugin (v2.0.0), the XSS-family substring rules — innerHTML_xss, react_dangerously_set_html, document_write_xss, new_function_injection — fire on documentation/prose files that merely mention the pattern, e.g. a markdown note documenting an incident or a coding guideline that quotes el.innerHTML = ....
patterns.py already solves this exact problem for other rules: eval_injection carries "path_filter": lambda p: not p.endswith(_DOC_EXTS) ("Skip doc/prose files"), and pickle_deserialization is scoped to _PY_EXTS. The XSS-family substring rules are the remaining ones with no path scoping, so they warn on .md/.txt/.rst/.yaml content where nothing executes.
Repro
- Enable the plugin, then Write/Edit a markdown file containing the literal text
el.innerHTML = r.svg (e.g. a post-mortem note).
- PostToolUse fires: "⚠️ Security Warning: Setting innerHTML with untrusted content can lead to XSS..."
Expected: no warning for doc/prose files, consistent with eval_injection.
Proposed fix (4 lines)
Add the same carve-out the file already uses:
# in each of: new_function_injection, react_dangerously_set_html,
# document_write_xss, innerHTML_xss
"path_filter": lambda p: not p.endswith(_DOC_EXTS),
Happy to send this as a PR if code contributions to the plugin are accepted here.
Why it matters
Advisory noise on prose trains users (and agents) to either ignore the warnings or over-react to them — we hit a case where a reflexive "fix" in response to a false positive introduced a real rendering regression. Related in spirit: #82484 (allowlist/exemption mechanism).
Summary
In the
security-guidanceplugin (v2.0.0), the XSS-family substring rules —innerHTML_xss,react_dangerously_set_html,document_write_xss,new_function_injection— fire on documentation/prose files that merely mention the pattern, e.g. a markdown note documenting an incident or a coding guideline that quotesel.innerHTML = ....patterns.pyalready solves this exact problem for other rules:eval_injectioncarries"path_filter": lambda p: not p.endswith(_DOC_EXTS)("Skip doc/prose files"), andpickle_deserializationis scoped to_PY_EXTS. The XSS-family substring rules are the remaining ones with no path scoping, so they warn on.md/.txt/.rst/.yamlcontent where nothing executes.Repro
el.innerHTML = r.svg(e.g. a post-mortem note).Expected: no warning for doc/prose files, consistent with
eval_injection.Proposed fix (4 lines)
Add the same carve-out the file already uses:
Happy to send this as a PR if code contributions to the plugin are accepted here.
Why it matters
Advisory noise on prose trains users (and agents) to either ignore the warnings or over-react to them — we hit a case where a reflexive "fix" in response to a false positive introduced a real rendering regression. Related in spirit: #82484 (allowlist/exemption mechanism).