shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix HTML export URL sanitization

Browse Source
This commit is contained in:
Mario Zechner
2026-06-02 16:30:14 +02:00
parent 7e72ca47c8
commit 6cb23f9b5d
3 changed files with 30 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
packages/coding-agent/test/export-html-xss.test.ts
View File

@@ -4,15 +4,20 @@ import { describe, expect, it } from "vitest";
describe("export HTML markdown link sanitization", () => {
const templateJs = readFileSync(new URL("../src/core/export-html/template.js", import.meta.url), "utf-8");
it("overrides the marked link renderer to block javascript: protocol", () => {
// The custom link renderer must check for dangerous protocols
it("overrides the marked link renderer to use scheme allow-list sanitization", () => {
expect(templateJs).toMatch(/link\s*\(\s*token\s*\)/);
expect(templateJs).toMatch(/javascript/i);
expect(templateJs).toMatch(/vbscript/i);
expect(templateJs).toMatch(/sanitizeMarkdownUrl\(token\.href\)/);
expect(templateJs).toMatch(/\^\(https\?\|mailto\|tel\|ftp\)/);
});
it("overrides the marked image renderer to block javascript: protocol", () => {
it("overrides the marked image renderer to use scheme allow-list sanitization", () => {
expect(templateJs).toMatch(/image\s*\(\s*token\s*\)/);
expect(templateJs).toMatch(/sanitizeMarkdownUrl\(token\.href\)/);
});
it("strips C0 controls before checking and emitting markdown URLs", () => {
expect(templateJs).toContain("replace(/[\\x00-\\x1f\\x7f]/g, '')");
expect(templateJs).not.toMatch(/\^\\s\*\(javascript\|vbscript\|data\):/i);
});
it("escapes href attributes in the custom link renderer", () => {