Always neutralize javascript: links, independent of fixRelativeURLs

[fivefilters]

Summary

A security review of the library turned up one concrete, user-facing regression from upstream Readability.js. The input/parsing side is otherwise in good shape (no XXE — the native \Dom\HTMLDocument/Lexbor parser has no DTD/entity surface; no SSRF — nothing is fetched; no ReDoS in the built-in regexes; no dynamic-exec sinks).

The regression: Readability.js always runs _fixRelativeUris inside _postProcessContent, which neutralizes <a href="javascript:..."> links. This port gated the entire fixRelativeUris() step behind the fixRelativeURLs config flag, which defaults to false. So with the default configuration, javascript: links passed straight through to Article::$content, unlike upstream.

The test corpus masked this because its harness always sets fixRelativeURLs: true (test/ReadabilityTest.php:130), mirroring the fact that jsdom always supplies a base URI.

What changed

• src/Readability.php — decouple the two concerns in postProcessContent() / fixRelativeUris(). The javascript: neutralization now always runs (it needs no base URL and is a defense-in-depth measure); absolutizing relative href/src/srcset/poster values stays opt-in behind fixRelativeURLs && baseURI !== null.
• test/ReadabilityUnitTest.php — add a regression test that parses a javascript: anchor with the default Configuration and asserts the scheme is gone while the link text survives. Verified it fails before the fix and passes after.
• README.md / UPGRADE.md — expand the Security notes: state plainly that the output is extracted, not sanitized, and enumerate what survives extraction (inline on* handlers, data:/non-http URIs on media and lazy images, whitelisted video <iframe>/<embed>/<object>), plus operational guidance on maxElemsToParse and treating allowedVideoRegex as trusted config.

This intentionally does not add on-handler stripping or cross-sink scheme filtering — that would deviate from Readability's deliberate "extractor, not sanitizer" design, which the README already directs callers to pair with a real sanitizer.

Testing

• ./vendor/bin/phpunit — all 473 tests pass, including the full Mozilla corpus (the js-link-replacement fixture, which runs with fixRelativeURLs on, is unaffected).
• New regression test confirmed red before the fix, green after.
• ./vendor/bin/psalm — no errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WPggv1W7LrNiWLDrHas5WU

---

Generated by Claude Code