[hivecommons-hive]

Security Fix

remoteTarget() in scripts/lib/svg-active-content.mjs is the single host
test behind findRemoteReferences(). It accepted only https?:// and a //
prefix.

The WHATWG URL standard treats \ as equivalent to / in the scheme and
authority prefix of a special-scheme URL, and the site is served over
https, so every relative reference in a published SVG resolves against a
special-scheme base. These values therefore reach a third-party host exactly
as //host does, while the gate reported every one of them local:

value in the SVG	resolves to	before	after
\\evil.example/p	https://evil.example/p	missed	flagged
/\evil.example/p	https://evil.example/p	missed	flagged
\/evil.example/p	https://evil.example/p	missed	flagged
https:\\evil.example/p	https://evil.example/p	missed	flagged
https:/\evil.example/p	https://evil.example/p	missed	flagged
//evil.example/p	https://evil.example/p	flagged	flagged

Because findRemoteReferences() routes every href/src value and every
url()/@import CSS target through remoteTarget(), the bypass applied to
all of them at once, and it is the only remote-reference check in
scripts/lib/enduser-collector.mjs:201 as well.

What changed

remoteTarget() now normalizes the leading authority prefix the way the URL
parser does, translating \ to / only in the leading run of separators.

The narrow scope is deliberate and is pinned by tests: a single leading
separator keeps the value on this origin (\host is the path /host, and
https:/host likewise), and an interior backslash stays an ordinary path
character, so a\b/c.png and ./sub\dir/x.png still report local. Widening
the translation would have failed diagrams that reference their own sibling
assets.

Verification

End to end through the real validator, with the PoC planted under
static/img/architectures/:

before:  Validated 173 architecture asset(s).          exit 0
after:   2 error(s) in architecture assets:            exit 1
           remote reference: ... <image> href: //evil.example/track.png
           remote reference: ... <use> xlink:href: //evil.example/sprite.svg#g

• npm run test:unit — 1923/1923 pass (1912 baseline + 11 added here)
• Reverting only the remoteTarget() change fails 7 of the 11 added tests, so
  they are load-bearing rather than restating current behaviour
• npm run check:format clean
• npm run test:unit:coverage:check passes (99.40% lines / 94.88% regions)

Scope

Touches remoteTarget() only (scripts/lib/svg-active-content.mjs:243) plus
its tests. Deliberately disjoint from the other open held PRs:

• fix(security): scan <style> CSS past a CDATA-hidden </style> #1044 edits STYLE_BLOCK_PATTERN/styleBlockContents in the same file at
  lines 210-220 and 308-315 — different function, non-overlapping hunks
• fix(security): gate mirrored artwork SVGs on findRemoteReferences() #1056 makes mirrorArtworkUrls() call this gate; this PR fixes what the
  gate tests. Complementary, different file
• fix: require https for mirrored cncf/artwork URLs #1063 edits project-assets.mjs

Closes #1067

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "sec-check". If this is an outreach PR, a human must review it and remove the label.