- ${homeCfg?.footerLinks ? homeCfg.footerLinks.map(l => `${_renderHomeLabel(l.label)}`).join('') : `
+ ${homeCfg?.footerLinks ? homeCfg.footerLinks.map(footerLinkHtml).join('') : `
Packets
Network Map
Live
diff --git a/public/roles.js b/public/roles.js
index f01a5f37f..e31710334 100644
--- a/public/roles.js
+++ b/public/roles.js
@@ -1047,19 +1047,47 @@
/* RFC 3986 scheme grammar, lowercased before matching. */
var LINK_SCHEME_RE = /^([a-z][a-z0-9+.\-]*):/;
+ /* True when `url` may become a link or resource URL: it carries no scheme
+ (relative path, #fragment, ?query) or an allowlisted one. Normalisation
+ mirrors what a browser does before it resolves a scheme: ASCII controls
+ and ASCII whitespace are ignored, and the scheme is case-insensitive. So
+ `JaVa\tScRiPt:alert(1)` is rejected for the same reason
+ `javascript:alert(1)` is. #429: exported as the one scheme check for
+ every customization-fed URL sink (Home footer links, branding logo and
+ favicon), so no sink grows an allowlist of its own. */
+ function linkUrlProbe(url) {
+ return String(url == null ? '' : url).replace(/[\u0000-\u0020\u007f]/g, '').toLowerCase();
+ }
+ function isSafeLinkUrl(url) {
+ var probe = linkUrlProbe(url);
+ if (!probe) return false;
+ var m = LINK_SCHEME_RE.exec(probe);
+ return !m || SAFE_LINK_SCHEMES.indexOf(m[1]) !== -1;
+ }
+ window.isSafeLinkUrl = isSafeLinkUrl;
+ /* #429 — image sinks (branding logo, favicon) take the same check plus
+ inline data:image/ URLs: an ![]()
or icon never runs script from its URL,
+ and the customizer has always accepted an inline logo. */
+ window.isSafeImageUrl = function(url) {
+ return isSafeLinkUrl(url) || linkUrlProbe(url).indexOf('data:image/') === 0;
+ };
+
/* Returns the escaped href for `dest`, or '' when the destination must not
- become a link. Normalisation mirrors what a browser does before it
- resolves a scheme: ASCII controls and ASCII whitespace are ignored, and
- the scheme is case-insensitive. So `JaVa\tScRiPt:alert(1)` is rejected for
- the same reason `javascript:alert(1)` is. */
+ become a link. `dest` is already & < > escaped (see miniMarkdown). */
function safeLinkHref(dest) {
var raw = String(dest == null ? '' : dest);
- var probe = raw.replace(/[\u0000-\u0020\u007f]/g, '').toLowerCase();
- if (!probe) return '';
- var m = LINK_SCHEME_RE.exec(probe);
- if (m && SAFE_LINK_SCHEMES.indexOf(m[1]) === -1) return '';
- return escapeAttr(raw);
+ return isSafeLinkUrl(raw) ? escapeAttr(raw) : '';
}
+
+ /* #429 — the same check for a RAW url headed for a quoted HTML attribute:
+ returns the fully escaped value (& < > " '), or '' when it must not
+ become a link. '&' matters here: left alone, `javascript:` carries
+ no scheme for the check but is decoded back into `javascript:` while the
+ browser parses the attribute. */
+ window.safeUrlAttr = function(url) {
+ return safeLinkHref(String(url == null ? '' : url)
+ .replace(/&/g, '&').replace(//g, '>'));
+ };
// Simple markdown → HTML (bold, italic, links, code, lists, line breaks)
window.miniMarkdown = function(text) {
if (!text) return '';
diff --git a/test-all.sh b/test-all.sh
index ee9efaf9e..fea6fde36 100755
--- a/test-all.sh
+++ b/test-all.sh
@@ -200,6 +200,7 @@ run test-issue-1107-live-layout.js
run test-issue-1619-feed-detail-card-draggable.js
run test-xss-escape-sinks.js
run test-issue-368-minimarkdown-links.js
+run test-issue-429-config-url-schemes.js
run test-issue-393-slowpath-doc-bound.js
run test-preflight-xss-gate.js
run test-issue-1648-m4-emoji-scan.js
diff --git a/test-issue-429-config-url-schemes.js b/test-issue-429-config-url-schemes.js
new file mode 100644
index 000000000..e6ad2c0a2
--- /dev/null
+++ b/test-issue-429-config-url-schemes.js
@@ -0,0 +1,274 @@
+/**
+ * test-issue-429-config-url-schemes.js
+ *
+ * Issue #429 — #420 (#368) gave miniMarkdown() link destinations a scheme
+ * allowlist, but the same Home customization source still had an href sink
+ * with no scheme check: footerLinks[].url in public/home.js, rendered as
+ * href="${escapeAttr(l.url)}". escapeAttr only covers the two quote
+ * characters, so `javascript:` went straight through, and so did an
+ * entity-encoded scheme (`javascript:`) that the browser decodes back
+ * into `javascript:` when it parses the attribute.
+ *
+ * The other URL sinks fed by importable customization are the branding
+ * logo / favicon setters in public/customize-v2.js. They now go through the
+ * same check.
+ *
+ * These tests drive the REAL helpers from public/roles.js in a vm sandbox
+ * and pin, at source level, that the sinks use them instead of growing a
+ * second allowlist. The browser-level counterpart (what the Home page and
+ * the navbar actually render and execute) is test-xss-429-home-footer-e2e.js.
+ *
+ * Mutants this file must catch (verified by hand, see the PR):
+ * N1 safeUrlAttr() stops escaping '&' -> B2 red
+ * N2 isSafeLinkUrl() drops the control/whitespace strip -> B1 red
+ * N3 isSafeLinkUrl() accepts every scheme -> B1, B3 red
+ * N4 home.js footer goes back to escapeAttr(l.url) -> B4 red
+ * N5 a .brand-icon innerHTML logo sink comes back -> B5 red
+ * N9 isSafeImageUrl() accepts any data: URL -> B6 red
+ */
+'use strict';
+const vm = require('vm');
+const fs = require('fs');
+const assert = require('assert');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+ try { fn(); passed++; console.log(' ✅ ' + name); }
+ catch (e) { failed++; console.log(' ❌ ' + name + ': ' + e.message); }
+}
+
+// --- Load public/roles.js the way index.html does -----------------------
+function loadRoles() {
+ const ctx = {
+ window: { addEventListener: () => {}, dispatchEvent: () => {} },
+ document: {
+ readyState: 'complete',
+ createElement: () => ({ id: '', textContent: '', innerHTML: '', style: {} }),
+ head: { appendChild: () => {} },
+ getElementById: () => null,
+ addEventListener: () => {},
+ querySelectorAll: () => [],
+ querySelector: () => null,
+ },
+ console, Date, Math, JSON, RegExp, Error, TypeError,
+ parseInt, parseFloat, isNaN, isFinite,
+ encodeURIComponent, decodeURIComponent,
+ setTimeout: () => {}, clearTimeout: () => {},
+ localStorage: { getItem: () => null, setItem: () => {}, removeItem: () => {} },
+ location: { hash: '' },
+ navigator: {},
+ fetch: () => Promise.resolve({ json: () => Promise.resolve({}) }),
+ };
+ vm.createContext(ctx);
+ vm.runInContext(fs.readFileSync('public/roles.js', 'utf8'), ctx);
+ return ctx.window;
+}
+const W = loadRoles();
+const isSafe = W.isSafeLinkUrl;
+const safeAttr = W.safeUrlAttr;
+
+// Hostile URLs, raw (as they would sit in a customization JSON). Every one
+// carries a scheme that is not http/https once case and the ASCII
+// controls/whitespace a browser ignores are taken out.
+const HOSTILE = [
+ ['plain javascript:', 'javascript:alert(1)'],
+ ['mixed case', 'JaVaScRiPt:alert(1)'],
+ ['upper case', 'JAVASCRIPT:alert(1)'],
+ ['leading spaces', ' javascript:alert(1)'],
+ ['leading TAB/LF', '\t\njavascript:alert(1)'],
+ ['leading C0 control', '\u0001javascript:alert(1)'],
+ ['embedded TAB', 'java\tscript:alert(1)'],
+ ['embedded LF', 'java\nscript:alert(1)'],
+ ['embedded CR', 'java\rscript:alert(1)'],
+ ['embedded NUL', 'java\u0000script:alert(1)'],
+ ['embedded DEL', 'java\u007fscript:alert(1)'],
+ ['space before colon', 'javascript :alert(1)'],
+ ['data: html', 'data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='],
+ ['data: svg image', 'data:image/svg+xml,