@checkstack/ui 1.8.2 → 1.8.3

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @checkstack/ui
 
+## 1.8.3
+
+### Patch Changes
+
+- 1909a61: Address open CodeQL code-scanning findings:
+
+  - **`@checkstack/ui` (`LinksEditor`)**: validate URL scheme on render and on
+    add; only `http:` / `https:` URLs are accepted, defeating stored XSS via
+    `javascript:` / `data:` schemes in user-supplied hotlinks
+    (`js/xss-through-dom`).
+  - **`@checkstack/backend-api` (`markdownToPlainText`)**: decode HTML entities
+    before stripping tags, then strip tags in a loop until the output
+    stabilizes. Decoding `&` last avoids reintroducing tag delimiters
+    via `<` round-trips (`js/double-escaping`,
+    `js/incomplete-multi-character-sanitization`).
+  - **`@checkstack/backend` (`createScopedWsRegistry`)**: drop the
+    identity-replacement on the path suffix; the leading-slash invariant
+    is documented on `WebSocketRouteRegistry` (`js/identity-replacement`).
+
 ## 1.8.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/ui",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",

package/src/components/LinksEditor.tsx

@@ -10,6 +10,24 @@ export interface HotLink {
   url: string;
 }
 
+// Parse a user-supplied URL and return its canonicalized form ONLY when the
+// scheme is `http:` / `https:`. Returns `undefined` for any other scheme
+// (`javascript:`, `data:`, `vbscript:`, etc.) so callers can refuse to
+// render an anchor at all. The returned string is `URL.toString()` — i.e.
+// a re-serialized URL — so taint analysis sees a fresh, sanitized value
+// rather than the raw input flowing through. CodeQL js/xss-through-dom.
+function safeHref(raw: string): string | undefined {
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return parsed.toString();
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export interface LinksEditorProps<T extends HotLink> {
   /** Currently attached links. */
   links: T[];
@@ -60,6 +78,11 @@ export function LinksEditor<T extends HotLink>({
       setError("Must be a valid URL (include http:// or https://)");
       return;
     }
+    const parsed = new URL(trimmedUrl);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      setError("Only http:// and https:// URLs are allowed");
+      return;
+    }
     setError(undefined);
     await onAdd({ label: label.trim() || undefined, url: trimmedUrl });
     setLabel("");
@@ -77,42 +100,54 @@ export function LinksEditor<T extends HotLink>({
 
       {links.length > 0 ? (
         <div className="border rounded-lg divide-y">
-          {links.map((link) => (
-            <div
-              key={link.id}
-              className="flex items-center justify-between p-3 gap-2"
-            >
-              <div className="flex items-center gap-2 min-w-0 flex-1">
-                <ExternalLink className="h-4 w-4 text-muted-foreground shrink-0" />
-                <div className="min-w-0">
-                  <a
-                    href={link.url}
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    className="text-sm text-primary hover:underline truncate block"
-                  >
-                    {link.label ?? link.url}
-                  </a>
-                  {link.label && (
-                    <span className="text-xs text-muted-foreground truncate block">
-                      {link.url}
-                    </span>
-                  )}
+          {links.map((link) => {
+            const href = safeHref(link.url);
+            return (
+              <div
+                key={link.id}
+                className="flex items-center justify-between p-3 gap-2"
+              >
+                <div className="flex items-center gap-2 min-w-0 flex-1">
+                  <ExternalLink className="h-4 w-4 text-muted-foreground shrink-0" />
+                  <div className="min-w-0">
+                    {href ? (
+                      <a
+                        href={href}
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="text-sm text-primary hover:underline truncate block"
+                      >
+                        {link.label ?? link.url}
+                      </a>
+                    ) : (
+                      <span
+                        className="text-sm text-muted-foreground truncate block"
+                        title="Unsafe URL scheme — link disabled"
+                      >
+                        {link.label ?? link.url}
+                      </span>
+                    )}
+                    {link.label && (
+                      <span className="text-xs text-muted-foreground truncate block">
+                        {link.url}
+                      </span>
+                    )}
+                  </div>
                 </div>
+                {canManage && (
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    onClick={() => void onRemove(link)}
+                    disabled={busy}
+                    aria-label="Remove link"
+                  >
+                    <Trash2 className="h-4 w-4" />
+                  </Button>
+                )}
               </div>
-              {canManage && (
-                <Button
-                  variant="ghost"
-                  size="sm"
-                  onClick={() => void onRemove(link)}
-                  disabled={busy}
-                  aria-label="Remove link"
-                >
-                  <Trash2 className="h-4 w-4" />
-                </Button>
-              )}
-            </div>
-          ))}
+            );
+          })}
         </div>
       ) : (
         <p className="text-sm text-muted-foreground">No links attached</p>