@37signals/lexxy 0.9.31-beta → 0.9.31

package/dist/lexxy.esm.js

@@ -129,7 +129,8 @@ var Lexxy = {
 // Until 3.3.2 that never came up: attributes admitted by a *functional* ADD_ATTR
 // skipped URI validation entirely (GHSA-cjmm-f4jc-qw8r), which is how data:
 // URLs worked here — and, less happily, how `url="javascript:…"` survived too.
-// The fix restored validation for both.
+// The fix restored validation for both. The bypass was reported to us by
+// @petitpois via HackerOne.
 //
 // So `url` is marked URI-safe, which hands the decision to this hook. The hook
 // only ever removes an attribute — it never force-keeps one — so scoping stays
@@ -152,9 +153,41 @@ var Lexxy = {
 // ordinary prose like "Q4: results" is not a URI any regex here would accept.
 const URI_BEARING_ATTACHMENT_ATTRIBUTES = [ "url" ];
 
-// DOMPurify's own IS_ALLOWED_URI, reproduced rather than narrowed, so `url` on a
-// non-attachment tag is treated exactly as DOMPurify would have treated it.
-const ALLOWED_URI = /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.-]+(?:[^a-z+.:-]|$))/i;
+// DOMPurify's own IS_ALLOWED_URI scheme list, reproduced rather than narrowed, so
+// `url` on a non-attachment tag is treated exactly as DOMPurify would have treated
+// it. Kept as a source string so allowedUriRegexp() can widen it with an editor's
+// declared schemes without re-deriving the rest of the pattern.
+const BASE_URI_SCHEMES = "(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix";
+
+// A scheme name (not a full pattern), so a caller can't inject regexp syntax.
+const SCHEME_NAME = /^[a-z][a-z0-9+.-]*$/;
+
+// The executable schemes, by DOMPurify's own IS_SCRIPT_OR_DATA definition
+// (/^(?:\w+script|data):/i): javascript, vbscript, …script, and data. Widening the
+// allowlist to admit one would let it survive on href/object[data], which the
+// override otherwise defeats — DOMPurify does not re-block a scheme its
+// ALLOWED_URI_REGEXP accepts. A caller declaring one is dropped, so it stays
+// refused. This is a closed set (the schemes a browser executes), not a growing
+// denylist.
+const EXECUTABLE_SCHEME = /^(?:\w+script|data)$/i;
+
+// Builds DOMPurify's default IS_ALLOWED_URI, optionally with extra schemes folded
+// into the scheme alternation. Widening the recognised-safe scheme set is how a
+// custom-scheme identifier (a mention's `gid://…`) passes validation without
+// exempting any attribute from it. Passing no schemes reproduces DOMPurify's
+// default exactly.
+function allowedUriRegexp(extraSchemes = []) {
+  const extra = extraSchemes
+    .map(scheme => String(scheme).toLowerCase())
+    .filter(scheme => SCHEME_NAME.test(scheme) && !EXECUTABLE_SCHEME.test(scheme))
+    .map(scheme => scheme.replace(/[.+-]/g, "\\$&"));
+
+  const schemes = [ BASE_URI_SCHEMES, ...extra ].join("|");
+
+  return new RegExp(`^(?:(?:${schemes}):|[^a-z]|[a-z+.-]+(?:[^a-z+.:-]|$))`, "i")
+}
+
+const ALLOWED_URI = allowedUriRegexp();
 
 // eslint-disable-next-line no-control-regex -- mirrors DOMPurify's own ATTR_WHITESPACE
 const ATTR_WHITESPACE = /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g;
@@ -351,7 +384,17 @@ function buildConfig(allowedElements = null) {
   // default tag and attribute policy stands. `ALLOWED_TAGS: []` would not be a
   // default, it would be a refusal: it strips every tag. An editor that declares
   // an empty allowlist still gets that refusal, because it asked for it.
-  if (allowedElements) Object.assign(config, allowlistFor(allowedElements));
+  //
+  // uriSafeSchemes widens the scheme validation rather than exempting an attribute
+  // from it: ALLOWED_URI_REGEXP is set only when an editor declares custom schemes,
+  // so a value like a mention's `gid://…` passes while javascript:/data: stay
+  // refused on every attribute — including href and object[data]. Nothing is taken
+  // out of URI checking, so there is no attribute to guard against exempting.
+  if (allowedElements) {
+    const { uriSafeSchemes, ...tagPolicy } = allowlistFor(allowedElements);
+    if (uriSafeSchemes.length) config.ALLOWED_URI_REGEXP = allowedUriRegexp(uriSafeSchemes);
+    Object.assign(config, tagPolicy);
+  }
 
   // Always assigned, including when we have no policy — `null` is what
   // trustedTypesPolicy() returns then, and `TRUSTED_TYPES_POLICY: null` is
@@ -374,6 +417,7 @@ function allowlistFor(allowedElements) {
   // Object.prototype key: `tagAttributes["constructor"]` would answer with a
   // function, and ADD_ATTR would call .includes on it.
   const tagAttributes = Object.create(null);
+  const uriSafeSchemes = [];
 
   // Lowercased, because DOMPurify lowercases ALLOWED_TAGS and calls ADD_ATTR
   // with the lowercased tag and attribute names. Keeping the caller's casing
@@ -386,6 +430,15 @@ function allowlistFor(allowedElements) {
 
     tagAttributes[tag] ||= [];
     tagAttributes[tag].push(...attributes);
+
+    // A custom scheme a caller declares is folded into the editor's URI-scheme
+    // allowlist (ALLOWED_URI_REGEXP in buildConfig), so a value like a mention's
+    // `gid="gid://…"` — which DOMPurify otherwise drops as an unknown scheme, even
+    // once the `gid` name is allowed — passes validation. It widens the recognised
+    // schemes, it does not exempt an attribute: javascript:/data: stay refused
+    // everywhere, so there is no navigational attribute to guard. Declared per
+    // element for locality, but a scheme is editor-wide once allowed.
+    uriSafeSchemes.push(...(element.uriSafeSchemes ?? []));
   }
 
   // Only for tags the caller already permits — this widens what an allowed
@@ -397,7 +450,8 @@ function allowlistFor(allowedElements) {
   return {
     ALLOWED_TAGS: Object.keys(tagAttributes),
     ALLOWED_ATTR: ALLOWED_HTML_ATTRIBUTES,
-    ADD_ATTR: (attribute, tag) => tagAttributes[tag]?.includes(attribute)
+    ADD_ATTR: (attribute, tag) => tagAttributes[tag]?.includes(attribute),
+    uriSafeSchemes
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@37signals/lexxy",
-  "version": "0.9.31-beta",
+  "version": "0.9.31",
   "description": "Lexxy - A modern rich text editor for Rails.",
   "module": "dist/lexxy.esm.js",
   "type": "module",