Semantic Kernel Security Fixes: XSS Hardening and Cleanup

Vulnerability Overview The vulnerabilities mentioned in the webpage screenshot mainly involve the following aspects: 1. Azure OpenAI Model Discovery Identity Split - Description: During model discovery, management plane credentials are inconsistent with inference data plane identities or key paths. - Impact: May cause authentication issues during model discovery, affecting normal model operation. - Fix: Adjust model discovery logic to ensure consistency between management plane credentials and inference data plane identities or key paths. 2. Chat Model Icon Avatars - Description: Saved endpoint icons now appear in model-augmented responses while retaining agent avatar priority. - Impact: May affect user interface display but does not directly impact functionality. - Fix: Optimize icon display logic to ensure agent avatars are displayed with priority. 3. Tabular SK Python 3.13 Compatibility - Description: Updated public table kernel parameters to enable Semantic Kernel parsing on Python 3.12 and 3.13. - Impact: Ensures compatibility across different Python versions, avoiding issues caused by version differences. - Fix: Update relevant parameters to ensure compatibility with Python 3.12 and 3.13. 4. Python 3.12 CI and XSS Guardrail Cleanup - Description: Updated CI to Python 3.12 and adjusted changed rendering paths to meet XSS protection requirements without broad suppression. - Impact: Enhances system security and prevents XSS attacks. - Fix: Update CI configuration and adjust rendering paths to comply with XSS protection requirements. 5. PR Readiness Guardrail Cleanup - Description: Removed trailing spaces, unnecessary markers, UTF-8 BOM content, and documented reviewed plugin authorization boundaries for PR validation. - Impact: Improves code quality and security, reducing potential security risks. - Fix: Clean up unnecessary content in the code and document reviewed plugin authorization boundaries. 6. Governance Admin Rendering XSS Hardening - Description: Rebuilt changed governance, endpoint, agent, and plugin table rendering using DOM APIs and text nodes. - Impact: Enhances system security and prevents XSS attacks. - Fix: Reconstruct relevant rendering logic using DOM APIs and text nodes. 7. Group Workflow Assignment Cleanup - Description: Invalid nested JSON assignment payloads are discarded; group workflow assignment settings now retain only valid group UUIDs. - Impact: Ensures accuracy of group workflow assignments and avoids issues caused by invalid data. - Fix: Optimize assignment logic to ensure only valid group UUIDs are retained. 8. Workflow Activity Navigation and Group Activity Gate - Description: Workflow activity actions now keep the current tab open; group workflow activity views use group-specific authorization instead of individual workflow feature flags. - Impact: Improves user experience and ensures correct authorization for group workflow activities. - Fix: Optimize workflow activity navigation and authorization logic. 9. Tabular Inline Chart Handoff - Description: Successful grouped CSV/XLSX results now create deterministic SimpleChat inline charts for both streaming and non-streaming responses. - Impact: Improves the accuracy and consistency of chart generation. - Fix: Optimize chart generation logic to ensure result consistency. 10. Document Intelligence Upload Normalizer Import - Description: Fixed extraction schema normalizer parsing to prevent upload failures and circular import issues. - Impact: Ensures stability of document upload and processing. - Fix: Fix normalizer parsing logic to avoid upload failures and circular imports. 11. Cosmos Autoscale and Metrics Fixes - Description: Fixed native autoscale migration, background tasks, REST metadata parsing, container metric dimensions, cache status rendering, save button activation, refresh logs, and throughput performance. - Impact: Improves system stability and performance. - Fix: Fix related logic to ensure stable system operation. 12. Advanced Conversation Search Matching - Description: Advanced search now covers legacy and collaborative storage with explicit match patterns and normalized chat type filters. - Impact: Improves search accuracy and efficiency. - Fix: Optimize search logic to ensure match accuracy. 13. Visio Preview Fidelity Fixes - Description: Improved Visio preview rendering, including arcs, paths, master geometry, nested coordinates, connector lines, labels, embedded media, and runtime simplification. - Impact: Improves the accuracy and visual quality of Visio previews. - Fix: Optimize preview rendering logic to ensure visual fidelity. 14. Source Review Traversal and Citation Fixes - Description: Source review now receives full web search citation seeds, balances seeds and sub-pages, prioritizes relevant archived links, supports a more limited hop count, and exposes hidden audit details. - Impact: Improves the accuracy and transparency of source review. - Fix: Optimize source review logic to ensure accuracy a

Goal Reached Thanks to every supporter — we hit 100%!

Semantic Kernel Security Fixes: XSS Hardening and Cleanup

More from this source