Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix XSS potential #5157

Closed
wants to merge 5 commits into from
Closed

Fix XSS potential #5157

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8c1a285
Fix XSS potential
Nantris May 15, 2024
fca0b1d
Fix missing comma
Nantris May 15, 2024
6971e20
Fix linting complaints
Nantris May 15, 2024
715453f
Fix more lint issues
Nantris May 15, 2024
911cf67
Add eslint-disable
Nantris May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions packages/extension-link/src/link.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,13 +157,23 @@ export const Link = Mark.create<LinkOptions>({
},

parseHTML() {
return [{ tag: 'a[href]:not([href *= "javascript:" i])' }]
return [{
tag: 'a[href]',
getAttrs: dom => {
const href = dom.getAttribute('href')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think here we need a typecheck as dom apparently can also be a string (at least typescript says so) so you can't get the href directly from a string object as getAttribute does not exist


// eslint-disable-next-line no-script-url -- Check for any occurrence of 'javascript:'. Trim and lowercase both necessary
if (href && href.trim().toLowerCase().startsWith('javascript:')) {
return false
}
return { href }
},
}]
},

renderHTML({ HTMLAttributes }) {
// False positive; we're explicitly checking for javascript: links to ignore them
// eslint-disable-next-line no-script-url
if (HTMLAttributes.href?.startsWith('javascript:')) {
// eslint-disable-next-line no-script-url -- False positive; we're explicitly checking for javascript: links to ignore them. Trim and lowercase both necessary
if (HTMLAttributes.href?.trim().toLowerCase().startsWith('javascript:')) {
// strip out the href
return ['a', mergeAttributes(this.options.HTMLAttributes, { ...HTMLAttributes, href: '' }), 0]
}
Expand Down
Loading