Repository navigation
Sécurité : bloquer les liens javascript: via autoliens et URL entre chevrons - #46
Merged
Merged
Conversation
… links Two XSS vectors reached the output in the default (escaped) mode: - Angle-bracket destinations were checked before trimming, so [a](< javascript:alert(1)>) produced href=" javascript:alert(1)"; browsers strip the leading space and run the script on click. The check now runs on the trimmed URL (links and images). - URL autolinks were never scheme-checked: <javascript:alert(1)>, <vbscript:…> and <data:…> became clickable links. They are now rendered as literal text; other schemes (ftp:, irc:, …) still link, as CommonMark requires. The unit test that pinned javascript: autolinks as allowed is replaced by one asserting they are rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CPcuaaxrCottkeL1ykoSWe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problème : deux XSS en mode par défaut (sans
allowRawHtml)Je les ai trouvés en travaillant sur les liens.
main[a](``< javascript:alert(1)>``)<a href=" javascript:alert(1)">[a](``< javascript:alert(1)>``)'<img src=" javascript:alert(1)">'<javascript:alert(1)><a href="javascript:alert(1)"><vbscript:…>,<data:text/html;base64,…>isSafeAngleBracketUrl()vérifiait le schéma sans retirer les espaces.parse_url(" javascript:…")ne voit aucun schéma, donc l'URL passait. Or les navigateurs retirent les espaces de début et de fin d'unhref: le script s'exécute au clic.javascript:comme autorisé, avec le commentaire « les consommateurs filtrent eux-mêmes ». C'est incohérent avec[x](javascript:…), qui est déjà bloqué.Correctif
</my uri>) fonctionnent toujours.javascript,vbscriptoudatasont rendus en texte littéral échappé. Les autres schémas (ftp:,irc:…) restent des liens, comme le veut CommonMark §6.9.Tests
tests/Security/LinkSchemeBypassTest.php: 6 vecteurs, qui échouent tous surmain, plus 2 cas légitimes qui doivent continuer à marcher.AutolinkTest: le test qui exigeait que<javascript:…>devienne un lien est remplacé par un test à 4 cas qui vérifie le rejet.À merger en priorité. La PR sur les liens inline, qui arrive ensuite, s'appuie dessus.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CPcuaaxrCottkeL1ykoSWe
Generated by Claude Code