donghyeon.kang/tech-log-frontend
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: reject TechLog protocol-relative links

Browse Source
This commit is contained in:
DongHyeonka
2026-08-15 19:10:05 +09:00
parent 8342fb14dc
commit 708680b28e
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/features/tech-log/domain/content-format/parse-case-content.ts
+1
View File
@@ -199,6 +199,7 @@ function isSafeLink(href: string): boolean {
return false; return false;
} }
if (href.startsWith("#")) return true; if (href.startsWith("#")) return true;
if (href.startsWith("//")) return false;
if (href.startsWith("/")) { if (href.startsWith("/")) {
try { try {
return ( return (
tests/features/tech-log/content-format.test.ts
+5 -1
View File
@@ -39,6 +39,9 @@ describe("Content Format v1", () => {
"<script>alert(1)</script>", "<script>alert(1)</script>",
"[x](javascript:alert(1))", "[x](javascript:alert(1))",
"[x](//evil.example/path)", "[x](//evil.example/path)",
"[x](//techlog.invalid/path)",
"[x](///techlog.invalid/path)",
"[x](//user@techlog.invalid/path)",
"[x](/\\evil.example/path)", "[x](/\\evil.example/path)",
"[x](/\\\\evil.example/path)", "[x](/\\\\evil.example/path)",
"[x](</safe\u0001path>)", "[x](</safe\u0001path>)",
@@ -75,7 +78,7 @@ describe("Content Format v1", () => {
it("keeps explicitly allowed links and same-origin paths", () => { it("keeps explicitly allowed links and same-origin paths", () => {
const [paragraph] = parseCaseContent( const [paragraph] = parseCaseContent(
"[fragment](#section) [path](/safe/path?q=one) [http](http://example.com/path) [https](https://example.com/path) [mail](mailto:test@example.com)", "[fragment](#section) [path](/safe/path) [query](/safe/path?q=one) [http](http://example.com/path) [https](https://example.com/path) [mail](mailto:test@example.com)",
); );
expect(paragraph?.type).toBe("PARAGRAPH"); expect(paragraph?.type).toBe("PARAGRAPH");
@@ -86,6 +89,7 @@ describe("Content Format v1", () => {
.map((inline) => inline.href), .map((inline) => inline.href),
).toEqual([ ).toEqual([
"#section", "#section",
"/safe/path",
"/safe/path?q=one", "/safe/path?q=one",
"http://example.com/path", "http://example.com/path",
"https://example.com/path", "https://example.com/path",