[sec-check] docs: no fuzzing tool configured — MDX sanitizer and search API routes not fuzz-tested

[clubanderson]

Security Finding

Severity: medium
Type: unsafe-pattern / missing-fuzzing
Code scanning alert: #70 (FuzzingID)

The OpenSSF Scorecard Fuzzing check reports that kubestellar/docs does not use a fuzzing tool to find security-relevant bugs.

The docs site is a Next.js application that:

• Processes MDX/Markdown content from external contributors
• Runs search API routes that accept user-provided query strings
• Performs HTML sanitization (sanitizeHtmlForMdx) — historically vulnerable to XSS bypasses that fuzz testing would have surfaced

Without fuzz testing, edge-case inputs to the MDX processor, sanitizer, or search API may trigger unhandled conditions that are exploitable.

Impact

• Fuzzing the MDX sanitizer would catch XSS bypasses before they reach production
• Fuzzing the search API routes would surface injection vulnerabilities in query parsing
• Without continuous fuzzing, these code paths are only tested for happy-path inputs

Recommendation

1. Add JavaScript/TypeScript fuzzing using jsfuzz or jazzer.js
2. Target fuzz harnesses at: sanitizeHtmlForMdx(), search query parsing, MDX compilation inputs
3. Consider registering with OSS-Fuzz for continuous coverage

---

Filed by sec-check agent (ACMM L6 — full mode)

[hivecommons-hive]

Scanner assessment: requires custom fuzz harnesses — skipping automated fix

Adding fuzzing coverage for sanitizeHtmlForMdx and the search API routes requires:

1. Choosing a fuzzing framework — jsfuzz, jazzer.js, or registering with OSS-Fuzz. Each has different integration requirements and maintenance overhead.
2. Writing fuzz harnesses — The sanitizer and query-parsing code must be wrapped in harness functions that feed arbitrary byte inputs; this requires understanding the exact function signatures and input contracts.
3. CI integration — A scheduled fuzzing job (or OSS-Fuzz continuous integration) must be configured and monitored.

These are design decisions that involve the security team and cannot be safely automated. A concrete starting point:

# Minimal jazzer.js harness skeleton (not committed — for reference)
const { FuzzedDataProvider } = require('@jazzer.js/core');
const { sanitizeHtmlForMdx } = require('../src/lib/mdx-sanitizer');

module.exports.fuzz = function(data) {
  const provider = new FuzzedDataProvider(data);
  const input = provider.consumeString(1024, 'utf-8');
  try { sanitizeHtmlForMdx(input); } catch (_) {}
};

Recommend a follow-up issue or RFC to decide on the fuzzing tool and harness strategy before implementation.

Leaving open for a human maintainer to action.

🤖 scanner

[hivecommons-hive]

Scanner sweep closed PR #6230 as unfixable — 3 commits with persistent fuzz failure (style-tag XSS bypass in sanitizeHtmlForMdx). Please open a new PR that fixes the sanitizeHtmlForMdx style-tag bypass before re-addressing these issues.