Fix DSA page: use legal@hypercerts.org for EU representative - #11
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Free Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 Coding Plan
Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
hb-agent
pushed a commit
that referenced
this pull request
May 18, 2026
Closes the XSS class from AGENTS.md §22 pitfall #11: user-controlled URLs were rendered into `<a href={url}>` and `iframe src` without any scheme allowlist, so a `pub.leaflet.pages.linearDocument` record on any federated PDS could carry a `javascript:` URI that fires when a viewer clicks the link in a cert / profile / long-description. Five sites, one existing helper (`safeHttpUrl` from `src/lib/utils/safe-url.ts`) applied: - leaflet-document.tsx renderIframe — iframe fallback `<a>` when the host is not in the embed allowlist. `isAllowedEmbedHost` only inspects `hostname`, so `javascript:` (no host) fell through to the fallback anchor with the raw URI. - leaflet-document.tsx applyFacets — facet `<a href={linkUri}>` for bold/italic/link inline runs. The same `javascript:` payload could reach here via a foreign linearDocument record. - leaflet-iframe-node.tsx — TipTap node-view's unsupported-embed fallback `<a>` was the in-editor mirror of the same bug. - leaflet-editor.tsx handleLinkConfirm — TipTap's Link extension only runs `isAllowedUri` on `setLink`/`toggleLink`; the no-selection path uses `insertContent` which bypasses validation. Scheme-allowlist both branches before write. - link-dialog.tsx — reject non-http(s) URLs at submit with an inline error so the user gets immediate feedback instead of a silent drop. Defense in depth on the (de)serializer boundaries closes the re-publish path under the user's identity: - from-tiptap.ts marksToFeatures — drop the FEATURE_LINK when the href fails the allowlist. Without this, a malicious foreign record hydrated into the editor and then saved would re-publish the URI under the user's DID. - to-tiptap.ts featureToMark — drop the link mark on rejection so the editor surfaces the plain text and the in-memory JSON never carries the URI. Render-side rejections degrade to plain text (`<span>`) rather than silently dropping the content, so the user can still see the URL without one-click execution. CSS: new `.link-dialog__error` rule sized like `.link-dialog__hint` and themed via `--color-error`. tsc clean. Lint 38/38 (0 errors). Build green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Merged
10 tasks
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
holke@hypercerts.orgwithlegal@hypercerts.orgfor the EU representative contact on the DSA compliance pageTest plan
/dsasection 3 showslegal@hypercerts.orgas the EU representative email🤖 Generated with Claude Code