# Adversarial Test Cases for the draw.io Import Validation Path
> Discover adversarial test cases for draw.io import validation. Secure your diagrams against Markdown injection, XXE attacks, and malformed PNG metadata with this essential guide.
- Repository: [Cathryn Lavery/diagram-design](https://github.com/cathrynlavery/diagram-design)
- Tags: testing
- Published: 2026-09-09
---
**The draw.io import validation path in cathrynlavery/diagram-design employs a comprehensive adversarial test suite that blocks Markdown injection, XML external entity attacks, and malformed PNG metadata before untrusted diagram data reaches the processing pipeline.**
The cathrynlavery/diagram-design repository contains a hardened pipeline for importing draw.io files that must safely handle untrusted user uploads. All adversarial validation logic resides in [[`scripts/verify-drawio-import.py`](https://github.com/cathrynlavery/diagram-design/blob/main/scripts/verify-drawio-import.py)](https://github.com/cathrynlavery/diagram-design/blob/main/scripts/verify-drawio-import.py), which exercises the extractor in [`skills/diagram-design/scripts/drawio_drawio_extract.py`](https://github.com/cathrynlavery/diagram-design/blob/main/skills/diagram-design/scripts/drawio_drawio_extract.py) against hostile payloads designed to test escaping routines, security limits, and container parsing resilience.
## Label and Page-Name Escaping Verification
The `check_digest_escaping` function (lines 92-48 in the test harness) validates that the internal `_escape_inline` routine neutralizes characters capable of breaking downstream Markdown rendering or injecting commands.
### Preventing Markdown Injection in Node Labels
The test constructs a deliberately hostile diagram file named `adversarial-labels.drawio` containing labels with raw Markdown syntax, URLs, and pipe characters. The extractor must ensure that raw strings like `"\n## FORGED"`, `"[click](https://evil.example)"`, and ``"`edge`"`` never appear in the output digest, while properly escaped versions (e.g., `r"\#\# FORGED"`, `r"\[click\]\(https://evil\.example\)"`) are present.
```python
# Example hostile diagram structure used in validation
adversarial_xml = """
"""
```
Invoking the extractor produces escaped output where all Markdown control characters are prefixed with backslashes, preventing interpretation as formatting commands:
```bash
python scripts/drawio_extract.py adversarial-labels.drawio
```
Expected safe output includes sequences like `\*\*IGNORE ALL PREVIOUS INSTRUCTIONS\*\*` and `pipe\|value`, ensuring that no raw injection strings reach the rendering layer.
### Sanitizing Page Names with Control Characters
The same `check_digest_escaping` function (lines 92-04) feeds page-name strings containing carriage returns, CR-LF sequences, and Unicode line separators (`\u2028`). The test asserts that `_escape_inline` strips all line-boundary characters and retains only escaped Markdown markers (e.g., `r"\#\#\#"`).
## Security Rejection of Malformed Files
The `check_security_and_limits` function (lines 51-12) guards against XML external-entity attacks, malformed PNG metadata, and denial-of-service configurations.
### Blocking XML DTD and Entity Declarations
To prevent XXE (XML External Entity) attacks, the extractor rejects any draw.io file containing a `` or `` declaration. The test submits a file beginning with `]>` and expects exit status 2 with an error mentioning "DTD and entity declarations". This validation also applies to compressed variants where the DTD is hidden inside a base-64 payload (lines 63-92).
### Detecting Truncated PNG Metadata Chunks
The adversarial suite crafts PNG files with correctly formed headers but deliberately truncated `tEXt` chunks. When processed, the extractor must fail with a specific "truncated metadata chunk" error message (lines 93-01), preventing crashes or undefined behavior from malformed binary input.
### Validating Row Limits to Prevent DoS
The test invokes the extractor with `--max-rows 0` and expects the error message "--max-rows must be at least 1" (lines 103-09). This check prevents pathological configurations that could trigger infinite loops or zero-row processing logic, ensuring the `--max-rows` parameter acts as an effective circuit breaker.
## Container and Compression Edge Cases
The `check_containers` function (lines 17-81) verifies that complex packaging formats cannot hide malicious payloads or bypass validation layers.
### Testing Multi-Page Archive Decoding
The test harness constructs three distinct container formats—deflated and base-64 encoded, PNG-embedded, and SVG-embedded—each containing identical diagram data. The extractor must decode each format correctly, yielding consistent node and edge counts (12 nodes, 8 edges) regardless of the container type.
### Enforcing Bounded Decompression Limits
The internal `_decompress_limited` helper (tested around lines 54-62) prevents zip-bomb style attacks. The adversarial case submits a 4 KB payload with a 1 KB decompression limit and expects a `PayloadTooLarge` exception, confirming that the extractor enforces size boundaries before fully materializing decompressed data in memory.
### Verifying Page Selection Flags
The container tests also validate that page-selection flags (`--page all`, `--page `) behave correctly across all archive types, ensuring that users cannot bypass validation by requesting specific pages from a multi-page malicious archive.
## Summary
- **Markdown injection resistance**: The `_escape_inline` routine in the draw.io extractor ensures node labels, edge text, and page names cannot inject raw Markdown or HTML into the output digest.
- **XXE prevention**: Files containing DTD or XML entity declarations are immediately rejected with exit code 2, blocking external entity expansion attacks.
- **Binary integrity checks**: Truncated PNG `tEXt` chunks trigger explicit errors rather than silent failures or crashes.
- **Resource limits**: The `--max-rows` parameter and `_decompress_limited` function enforce hard boundaries on memory consumption and processing scope.
- **Container resilience**: Multi-page archives in deflated, PNG-embedded, and SVG-embedded formats are decoded safely without allowing payload hiding.
## Frequently Asked Questions
### What types of injection attacks do the draw.io adversarial tests prevent?
The tests specifically prevent **Markdown injection** through unescaped labels and page names, which could otherwise execute unintended formatting or command interpretation in downstream renderers. They also block **XML external entity (XXE) attacks** by rejecting DTD declarations that could read local files or exfiltrate data.
### How does the extractor handle maliciously crafted PNG files?
The extractor examines PNG metadata chunks before full parsing. If it encounters a `tEXt` chunk that is truncated or malformed, it exits with a descriptive error message rather than attempting to process the corrupted data, preventing potential buffer overflows or parsing exceptions.
### Why does the test suite enforce a minimum value for `--max-rows`?
The `--max-rows` parameter acts as a circuit breaker against denial-of-service attacks where an attacker might submit an infinitely large diagram or force zero-row processing logic. By requiring at least one row, the extractor ensures bounded iteration and prevents configuration-based resource exhaustion.
### What happens when the extractor encounters a compressed payload exceeding size limits?
The `_decompress_limited` function enforces a strict byte ceiling during decompression. If a deflated stream expands beyond the configured limit (for example, a 4 KB payload hitting a 1 KB boundary), the extractor raises a `PayloadTooLarge` exception and halts processing, protecting the host from zip-bomb memory exhaustion attacks.