lexxy 0.9.31.beta → 0.9.31

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3d24c12a246fe66d7a9a9c3921aa609ca8c4155f37fc6b98ed022199ffd59af
-  data.tar.gz: 6abd54bd70b2fb8fb558c2673cd8192e5c7843d15cea7df34eeaa18354d9c070
+  metadata.gz: 1f277ca33ab6c3af9fee1f22a40fe43fd177b1f26edc9e77495aaa0e8f95b387
+  data.tar.gz: 8db39c85a58a117b317d218089255909d1c56e2aaa65a82f2a0a9353b3d295a5
 SHA512:
-  metadata.gz: c27e4e5e9b880330b1ef962dcfea0e514eff42f2cdf51294956d8261b1d7e2c923f990755768e64d3dd4003532ccd83b4d97aade1ab5b673d5ad80fe6c5e4b7d
-  data.tar.gz: 6c3a620bd1634ad982080999499367301624b94d9a3acdb523e858e5f63db0cc4a77880f2d40e863d9586a9213d94f9cc39d48c3858b30dbb32598703a4bdb38
+  metadata.gz: 168d725c2c61d400b246f817ba2eb479240963121308403d206438cb3aecde44d39689e63a416d66b43afb3e0b1fe5b82ff5698ec75e14029725db63fbcd3657
+  data.tar.gz: bb669baeee9675aa52d7904aa0b712138500a7340aa72dc562a5386019843e0d5b3fd39be74c8e594f0faf4a8eb02aa6dc4af559eb5f3dbb4a91c67bd2985575

data/app/assets/javascript/lexxy.js

@@ -7658,7 +7658,8 @@ var Lexxy = {
 // Until 3.3.2 that never came up: attributes admitted by a *functional* ADD_ATTR
 // skipped URI validation entirely (GHSA-cjmm-f4jc-qw8r), which is how data:
 // URLs worked here — and, less happily, how `url="javascript:…"` survived too.
-// The fix restored validation for both.
+// The fix restored validation for both. The bypass was reported to us by
+// @petitpois via HackerOne.
 //
 // So `url` is marked URI-safe, which hands the decision to this hook. The hook
 // only ever removes an attribute — it never force-keeps one — so scoping stays
@@ -7681,9 +7682,41 @@ var Lexxy = {
 // ordinary prose like "Q4: results" is not a URI any regex here would accept.
 const URI_BEARING_ATTACHMENT_ATTRIBUTES = [ "url" ];
 
-// DOMPurify's own IS_ALLOWED_URI, reproduced rather than narrowed, so `url` on a
-// non-attachment tag is treated exactly as DOMPurify would have treated it.
-const ALLOWED_URI = /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.-]+(?:[^a-z+.:-]|$))/i;
+// DOMPurify's own IS_ALLOWED_URI scheme list, reproduced rather than narrowed, so
+// `url` on a non-attachment tag is treated exactly as DOMPurify would have treated
+// it. Kept as a source string so allowedUriRegexp() can widen it with an editor's
+// declared schemes without re-deriving the rest of the pattern.
+const BASE_URI_SCHEMES = "(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix";
+
+// A scheme name (not a full pattern), so a caller can't inject regexp syntax.
+const SCHEME_NAME = /^[a-z][a-z0-9+.-]*$/;
+
+// The executable schemes, by DOMPurify's own IS_SCRIPT_OR_DATA definition
+// (/^(?:\w+script|data):/i): javascript, vbscript, …script, and data. Widening the
+// allowlist to admit one would let it survive on href/object[data], which the
+// override otherwise defeats — DOMPurify does not re-block a scheme its
+// ALLOWED_URI_REGEXP accepts. A caller declaring one is dropped, so it stays
+// refused. This is a closed set (the schemes a browser executes), not a growing
+// denylist.
+const EXECUTABLE_SCHEME = /^(?:\w+script|data)$/i;
+
+// Builds DOMPurify's default IS_ALLOWED_URI, optionally with extra schemes folded
+// into the scheme alternation. Widening the recognised-safe scheme set is how a
+// custom-scheme identifier (a mention's `gid://…`) passes validation without
+// exempting any attribute from it. Passing no schemes reproduces DOMPurify's
+// default exactly.
+function allowedUriRegexp(extraSchemes = []) {
+  const extra = extraSchemes
+    .map(scheme => String(scheme).toLowerCase())
+    .filter(scheme => SCHEME_NAME.test(scheme) && !EXECUTABLE_SCHEME.test(scheme))
+    .map(scheme => scheme.replace(/[.+-]/g, "\\$&"));
+
+  const schemes = [ BASE_URI_SCHEMES, ...extra ].join("|");
+
+  return new RegExp(`^(?:(?:${schemes}):|[^a-z]|[a-z+.-]+(?:[^a-z+.:-]|$))`, "i")
+}
+
+const ALLOWED_URI = allowedUriRegexp();
 
 // eslint-disable-next-line no-control-regex -- mirrors DOMPurify's own ATTR_WHITESPACE
 const ATTR_WHITESPACE = /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g;
@@ -7880,7 +7913,17 @@ function buildConfig(allowedElements = null) {
   // default tag and attribute policy stands. `ALLOWED_TAGS: []` would not be a
   // default, it would be a refusal: it strips every tag. An editor that declares
   // an empty allowlist still gets that refusal, because it asked for it.
-  if (allowedElements) Object.assign(config, allowlistFor(allowedElements));
+  //
+  // uriSafeSchemes widens the scheme validation rather than exempting an attribute
+  // from it: ALLOWED_URI_REGEXP is set only when an editor declares custom schemes,
+  // so a value like a mention's `gid://…` passes while javascript:/data: stay
+  // refused on every attribute — including href and object[data]. Nothing is taken
+  // out of URI checking, so there is no attribute to guard against exempting.
+  if (allowedElements) {
+    const { uriSafeSchemes, ...tagPolicy } = allowlistFor(allowedElements);
+    if (uriSafeSchemes.length) config.ALLOWED_URI_REGEXP = allowedUriRegexp(uriSafeSchemes);
+    Object.assign(config, tagPolicy);
+  }
 
   // Always assigned, including when we have no policy — `null` is what
   // trustedTypesPolicy() returns then, and `TRUSTED_TYPES_POLICY: null` is
@@ -7903,6 +7946,7 @@ function allowlistFor(allowedElements) {
   // Object.prototype key: `tagAttributes["constructor"]` would answer with a
   // function, and ADD_ATTR would call .includes on it.
   const tagAttributes = Object.create(null);
+  const uriSafeSchemes = [];
 
   // Lowercased, because DOMPurify lowercases ALLOWED_TAGS and calls ADD_ATTR
   // with the lowercased tag and attribute names. Keeping the caller's casing
@@ -7915,6 +7959,15 @@ function allowlistFor(allowedElements) {
 
     tagAttributes[tag] ||= [];
     tagAttributes[tag].push(...attributes);
+
+    // A custom scheme a caller declares is folded into the editor's URI-scheme
+    // allowlist (ALLOWED_URI_REGEXP in buildConfig), so a value like a mention's
+    // `gid="gid://…"` — which DOMPurify otherwise drops as an unknown scheme, even
+    // once the `gid` name is allowed — passes validation. It widens the recognised
+    // schemes, it does not exempt an attribute: javascript:/data: stay refused
+    // everywhere, so there is no navigational attribute to guard. Declared per
+    // element for locality, but a scheme is editor-wide once allowed.
+    uriSafeSchemes.push(...(element.uriSafeSchemes ?? []));
   }
 
   // Only for tags the caller already permits — this widens what an allowed
@@ -7926,7 +7979,8 @@ function allowlistFor(allowedElements) {
   return {
     ALLOWED_TAGS: Object.keys(tagAttributes),
     ALLOWED_ATTR: ALLOWED_HTML_ATTRIBUTES,
-    ADD_ATTR: (attribute, tag) => tagAttributes[tag]?.includes(attribute)
+    ADD_ATTR: (attribute, tag) => tagAttributes[tag]?.includes(attribute),
+    uriSafeSchemes
   }
 }