@conduction/nextcloud-vue 2.56.0-beta.3 → 2.56.0-beta.5

package/src/integrations/builtin/xwiki/CnXwikiTab.vue

@@ -64,7 +64,6 @@
 				class="cn-xwiki-tab__banner-cta"
 				:href="banner.ctaHref || undefined"
 				:target="banner.ctaHref ? '_blank' : undefined"
-				:rel="banner.ctaHref ? 'noopener noreferrer' : undefined"
 				@click="banner.ctaHandler">
 				{{ banner.ctaLabel }}
 			</NcButton>
@@ -132,8 +131,7 @@
 						class="cn-xwiki-tab__open"
 						:closeAfterClick="true"
 						:href="pageHref(page)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -181,7 +179,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnXwikiPageCreate from '../../../components/CnXwikiPageCreate/CnXwikiPageCreate.vue'
 import CnXwikiPagePicker from '../../../components/CnXwikiPagePicker/CnXwikiPagePicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const EXCERPT_MAX_CHARS = 140
 
@@ -386,15 +384,17 @@ export default {
 
 		/**
 		 * External XWiki deep-link for the page. Empty string when the
-		 * provider didn't surface a `url`, so the row renders as a plain
-		 * (non-anchored) NcListItem rather than a dead link.
+		 * provider didn't surface a `url`, or surfaced an unsafe scheme, so
+		 * the row renders as a plain (non-anchored) NcListItem rather than a
+		 * dead link.
 		 *
 		 * @param {object} page Provider row.
 		 *
 		 * @return {string} Absolute XWiki URL or ''.
 		 */
 		pageHref(page) {
-			return String(page.url ?? '')
+			const url = String(page.url ?? '')
+			return url && safeHref(url) !== '#' ? url : ''
 		},
 
 		breadcrumbLabel(page) {

package/src/integrations/builtin/xwiki/__tests__/CnXwikiTab.spec.js

@@ -55,6 +55,15 @@ describe('CnXwikiTab', () => {
 		delete global.fetch
 	})
 
+	it('gives a page with an unsafe URL no link', async () => {
+		global.fetch = jest.fn().mockResolvedValue({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
+		const wrapper = mount(CnXwikiTab, { propsData: { ...DEFAULT_PROPS } })
+		await flushPromises()
+		expect(wrapper.vm.pageHref({ url: 'javascript:alert(1)' })).toBe('')
+		expect(wrapper.vm.pageHref({ url: 'https://wiki.example/p' })).toBe('https://wiki.example/p')
+		wrapper.unmount()
+	})
+
 	it('renders the empty state when no pages are linked', async () => {
 		global.fetch = jest.fn().mockResolvedValueOnce({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
 		const wrapper = mount(CnXwikiTab, { propsData: { ...DEFAULT_PROPS } })

package/src/schemas/app-manifest-v2.schema.json

@@ -3,7 +3,7 @@
 	"$id": "https://raw.githubusercontent.com/ConductionNL/nextcloud-vue/main/src/schemas/app-manifest-v2.schema.json",
 	"title": "Conduction App Manifest v2",
 	"description": "v2 schema for the JSON-driven page and navigation manifest consumed by @conduction/nextcloud-vue. Introduces a uniform widgets[] array on every page type with a per-slot grid coordinate system, a typed actions[] discriminator, and the required $schema field for version detection. v1 manifests continue to validate against app-manifest.schema.json (unchanged).",
-	"version": "2.41.0",
+	"version": "2.42.0",
 	"type": "object",
 	"required": ["$schema", "version"],
 	"allOf": [
@@ -98,6 +98,7 @@
 							"suggestMap": { "type": "object", "description": "choice: map of suggestFrom value → suggested option value. Used to auto-suggest a default (e.g. RGS template suggested from organisation type).", "additionalProperties": { "type": "string" } },
 							"multiple": { "type": "boolean", "default": false, "description": "choice: allow multi-select." },
 							"action": { "type": "string", "description": "run-action: actionId POSTed to /api/setup/action/{action}." },
+							"onDemand": { "type": "boolean", "default": false, "description": "run-action: the step runs only when the user clicks Run, never automatically, and is never outstanding work (it does not open the wizard or decide where a resumed wizard starts). The summary ticks it only when its action succeeded in the current session and shows it as not run otherwise, whatever the server reports. For destructive steps an app reports as done on purpose so they never auto-run, such as removing example data." },
 							"healthCheck": { "type": "boolean", "default": false, "description": "summary: render a health recap." },
 							"component": { "type": "string", "description": "component: app-registered component name (or use the #step-<id> slot)." }
 						}

package/src/utils/actionLink.js

@@ -62,6 +62,11 @@ export function resolveItemActionLink(action, item, router) {
  * on an in-app link that opens in place goes through the router; a URL, a
  * new-tab target or a modified click is left to the browser.
  *
+ * Hand-rolled rather than `NcActionRouter` / `NcButton :to`: the menus and
+ * bars using it must still emit their own events on click, and without an
+ * installed router `NcButton :to` falls back to a button that goes nowhere,
+ * while an `<a href>` still navigates.
+ *
  * @param {MouseEvent} event The click event.
  * @param {{to: (string|object|null), target: (string|undefined)}} link The resolved link.
  * @param {object} [router] The app's router.

package/src/utils/actionsDispatcher.js

@@ -341,6 +341,21 @@ export function interpolateActionTarget(target, ctx) {
 	return interpolateActionString(target || '', ctx || {})
 }
 
+// The tokens interpolateActionString resolves; a bare `@` or `{` is not one.
+const ACTION_TARGET_TOKEN = /@(?:objectId|object\.|page\.|workspace\.|config\.|range\.)|\{objectId\}/
+
+/**
+ * Whether an action target carries a token that interpolation would resolve,
+ * so it can only be known once the page context is. A `mailto:` address or a
+ * URL with an `@handle` in it has none.
+ *
+ * @param {string} target The action's raw `target`.
+ * @return {boolean}
+ */
+export function hasActionTargetTokens(target) {
+	return typeof target === 'string' && ACTION_TARGET_TOKEN.test(target)
+}
+
 /**
  * The link an action renders as when its only job is to navigate to a target
  * known at render time: `navigate` (token-interpolated like the dispatcher)

package/src/utils/linkNavigation.js

@@ -69,8 +69,11 @@ export function resolveHref(target, router) {
  * click is routed through the router; a modified click, or one a handler
  * already prevented, is left to the browser.
  *
+ * Unlike `resolveHref`, a string target is a router path, so pair the two
+ * with a location object (or `{ path }`) for the href and click to agree.
+ *
  * @param {MouseEvent} event The click event.
- * @param {string|object} target The router location the link points at.
+ * @param {string|object} target The router location the link points at; a string is a router path.
  * @param {object} [router] The app's router.
  * @return {boolean} True when the app navigated.
  */
@@ -96,8 +99,8 @@ export function followLinkClick(event, target, router) {
  *
  * A click that came from a control inside the surface (a button, a link, a
  * checkbox) is left to that control. Opening a new tab marks the event with
- * `preventDefault()`, and an event already marked that way is skipped, so
- * two listeners on the same click never open two tabs.
+ * `markNewTabHandled`, and an event already marked is skipped, so two
+ * listeners on the same click never open two tabs.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {string|object} target A URL, or a vue-router location.

package/src/utils/rowAuxClick.js

@@ -9,13 +9,17 @@
  * also fire `auxclick` for the right button, so a row that listens to it must
  * filter both out itself.
  *
- * Whoever opens a row in a new tab calls `preventDefault()` on the event, so a
- * second listener for the same click (a host behind a library default) can
+ * Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so
+ * a second listener for the same click (a host behind a library default) can
  * check `isNewTabHandled` and not open a second tab.
  *
  * @module utils/rowAuxClick
  */
 
+// Events that opened a new tab. Not `defaultPrevented`, which any unrelated
+// handler can set on a modified or middle click.
+const newTabHandled = new WeakSet()
+
 const NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role="button"], [role="checkbox"], [role="link"], [contenteditable="true"]'
 
 /**
@@ -49,6 +53,21 @@ export function isRowMiddleClick(event) {
 	return Boolean(event && event.button === 1 && !isFromNestedControl(event))
 }
 
+/**
+ * Cancel a middle-button press on a clickable row or card body, so the
+ * browser does not start autoscroll (Chrome/Edge on Windows) instead of the
+ * middle click opening the row. A press on a nested control, a link
+ * included, keeps its default.
+ *
+ * @param {MouseEvent} event The mousedown event.
+ * @return {void}
+ */
+export function preventMiddleClickAutoscroll(event) {
+	if (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {
+		event.preventDefault()
+	}
+}
+
 /**
  * Whether `openRowTarget` would open this click in a new tab.
  *
@@ -66,18 +85,24 @@ export function isNewTabClick(event) {
  * @return {boolean}
  */
 export function isNewTabHandled(event) {
-	return Boolean(isNewTabClick(event) && event.defaultPrevented)
+	return Boolean(isNewTabClick(event) && newTabHandled.has(event))
 }
 
 /**
  * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.
+ * Also prevents the event's default, so the browser does not act on the
+ * click as well.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {boolean} opened Whether the target was opened.
  * @return {void}
  */
 export function markNewTabHandled(event, opened) {
-	if (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {
+	if (!opened || !isNewTabClick(event)) {
+		return
+	}
+	newTabHandled.add(event)
+	if (typeof event.preventDefault === 'function') {
 		event.preventDefault()
 	}
 }

package/src/utils/safeHref.js

@@ -18,6 +18,20 @@
  * @module utils/safeHref
  */
 
+/**
+ * Whether a URL is protocol-relative the way a browser reads it: leading
+ * control characters and spaces are dropped, tabs and newlines are ignored
+ * anywhere, and a backslash counts as `/`.
+ *
+ * @param {string} url The URL.
+ * @return {boolean}
+ */
+function isProtocolRelative(url) {
+	// eslint-disable-next-line no-control-regex
+	const normalized = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '')
+	return /^[/\\]{2}/.test(normalized)
+}
+
 /**
  * Validate a URL and return it only if the scheme is safe for `:href`.
  *
@@ -30,7 +44,8 @@
  *   - `javascript:...`
  *   - `data:...`
  *   - `vbscript:...`
- *   - Protocol-relative `//attacker.com/...` (ambiguous origin)
+ *   - Protocol-relative `//attacker.com/...` (ambiguous origin), also as
+ *     `/\attacker.com` or with leading whitespace
  *   - Any other unrecognised scheme
  *   - `null`, `undefined`, empty string
  *
@@ -52,7 +67,7 @@ export function safeHref(url) {
 	}
 	// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative
 	// path but resolves to an arbitrary origin, bypassing same-origin intent.
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return '#'
 	}
 	// Allow root-relative paths (same-origin navigation)
@@ -97,7 +112,7 @@ export function safeImageSrc(url) {
 		return url
 	}
 	// Reject protocol-relative
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return ''
 	}
 	try {