test(sections-editor): cover rich-text link URL-scheme validation - #5012
Open
pedrofrxncx wants to merge 1 commit into
Open
test(sections-editor): cover rich-text link URL-scheme validation#5012pedrofrxncx wants to merge 1 commit into
pedrofrxncx wants to merge 1 commit into
Conversation
Adds regression coverage for isSafeLinkUrl/normalizeLinkUrl — the guard against javascript:/data:/vbscript: URLs in CMS rich-text links — including case, whitespace-in-scheme, and other unlisted-protocol bypass attempts. This trust-boundary function had zero test coverage; a regression here would let a rich-text link execute script for every visitor of the page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds regression coverage for
isSafeLinkUrl/normalizeLinkUrlinapps/mesh/src/web/components/sections-editor/rich-text-link-validation.ts.Source: no issue/PR — a gap found while auditing the sections-editor directory: this file had zero test coverage.
Why a maintainer wants it:
isSafeLinkUrlis the sole guard preventing a rich-text link inserted through the CMS editor from carrying ajavascript:/data:/vbscript:URL. Since links are rendered into<a href>for every visitor of the published page, a regression here (e.g. someone "simplifying" the protocol check, or an allowlist typo) would reopen a stored-XSS vector with no test to catch it.Trust-boundary justification (C4 gate): this directly meets the security/privacy bar — it validates an untrusted, user-typed URL that crosses into rendered HTML served to site visitors, and its explicit purpose (per its own docstring) is blocking script-executing protocols.
What the test covers: allowed protocols (https/http/mailto/tel/ftp) and relative/fragment links; blocked protocols including case-variant (
JavaScript:) and whitespace-in-scheme bypass attempts (java\tscript:,java\nscript:, leading space) that are known real-world sanitizer-bypass techniques, plus other unlisted protocols (ws:,chrome-extension:); andnormalizeLinkUrl's trim/bare-domain/pass-through behavior, confirming a dangerous URL that passes throughnormalizeLinkUrlunchanged still gets rejected byisSafeLinkUrl. I manually verified each bypass case against the actual implementation before writing the assertions (all currently pass — this is a coverage gap being closed, not a bug fix).Command a reviewer runs:
bun test apps/mesh/src/web/components/sections-editor/rich-text-link-validation.test.tsChecks run locally:
bun run fmt,bunx tsc --noEmitinapps/mesh(clean), and the targeted test file above (9 pass). Full CI validates the rest.Summary by cubic
Adds regression tests for
isSafeLinkUrlandnormalizeLinkUrlin the sections editor to ensure only safe link schemes are allowed and dangerous ones are blocked. Covers allowed protocols (https/http/mailto/tel/ftp), relative/fragment paths, blocks case/whitespace-bypass variants and other unlisted schemes, and verifies normalization behavior without weakening rejection.Written for commit 6634b00. Summary will update on new commits.