@moxxy/sdk 0.11.0 → 0.13.0

package/src/view-renderer.test.ts

@@ -3,11 +3,38 @@ import {
   VIEW_PRIMITIVES,
   VIEW_COMPONENTS,
   DEFAULT_VIEW_TAGS,
+  countNodes,
+  isSafeViewUrl,
   defineViewRenderer,
   defineTunnelProvider,
+  type ViewNode,
   type ViewTagSpec,
 } from './index.js';
 
+describe('countNodes', () => {
+  const text = (value: string): ViewNode => ({ kind: 'text', value });
+  const el = (tag: string, children: ViewNode[] = []): ViewNode => ({
+    kind: 'element',
+    tag,
+    props: {},
+    children,
+  });
+
+  it('counts a single text node as 1', () => {
+    expect(countNodes(text('hi'))).toBe(1);
+  });
+
+  it('counts an element plus its descendants', () => {
+    const tree = el('col', [el('row', [text('a'), text('b')]), text('c')]);
+    // col + row + a + b + c = 5
+    expect(countNodes(tree)).toBe(5);
+  });
+
+  it('counts a leaf element as 1', () => {
+    expect(countNodes(el('hr'))).toBe(1);
+  });
+});
+
 describe('view vocabulary integrity', () => {
   const all = DEFAULT_VIEW_TAGS;
 
@@ -88,3 +115,33 @@ describe('define factories freeze their specs', () => {
     expect(Object.isFrozen(def)).toBe(true);
   });
 });
+
+describe('isSafeViewUrl', () => {
+  it('rejects javascript/vbscript/data-text schemes', () => {
+    expect(isSafeViewUrl('javascript:alert(1)', 'href')).toBe(false);
+    expect(isSafeViewUrl('vbscript:msgbox', 'href')).toBe(false);
+    expect(isSafeViewUrl('data:text/html,<x>', 'src')).toBe(false);
+  });
+
+  it('rejects schemes split by whitespace/control chars (audit u72-1)', () => {
+    // a browser strips tab/newline/CR before scheme resolution, so these
+    // collapse to javascript: on click; the gate must normalize the same way
+    expect(isSafeViewUrl('java\tscript:alert(1)', 'href')).toBe(false);
+    expect(isSafeViewUrl('java\nscript:alert(1)', 'href')).toBe(false);
+    expect(isSafeViewUrl('java\rscript:alert(1)', 'href')).toBe(false);
+    expect(isSafeViewUrl('\u0000javascript:alert(1)', 'href')).toBe(false);
+    expect(isSafeViewUrl('  javascript:alert(1)', 'href')).toBe(false);
+  });
+
+  it('allows safe schemes + relative + data-image src', () => {
+    expect(isSafeViewUrl('https://example.com/x', 'href')).toBe(true);
+    expect(isSafeViewUrl('http://example.com', 'href')).toBe(true);
+    expect(isSafeViewUrl('mailto:a@b.com', 'href')).toBe(true);
+    expect(isSafeViewUrl('tel:+1555', 'href')).toBe(true);
+    expect(isSafeViewUrl('/relative/path', 'href')).toBe(true);
+    expect(isSafeViewUrl('#frag', 'href')).toBe(true);
+    expect(isSafeViewUrl('  https://example.com  ', 'href')).toBe(true);
+    expect(isSafeViewUrl('data:image/png;base64,AAAA', 'src')).toBe(true);
+    expect(isSafeViewUrl('data:image/png;base64,AAAA', 'href')).toBe(false);
+  });
+});

package/src/view-renderer.ts

@@ -108,7 +108,14 @@ export interface ViewRendererDef {
  * parties, so a `javascript:` link is click-XSS on a shared surface.
  */
 export function isSafeViewUrl(url: string, attr: string): boolean {
-  const u = url.trim().toLowerCase();
+  // Strip ALL ASCII whitespace + C0 control chars (U+0000–U+0020) anywhere in
+  // the URL before the scheme check — the HTML URL parser removes tab/newline/CR
+  // before resolving the scheme, so `java\tscript:` would otherwise pass this
+  // gate and then execute as `javascript:` on click (audit u72-1). The frontend
+  // copy in @moxxy/plugin-channel-web/src/frontend/url-safety.ts is a verbatim
+  // lockstep duplicate (the browser bundle can't import this root) — keep both
+  // in sync.
+  const u = url.replace(/[\u0000-\u0020]/g, '').toLowerCase();
   if (u.startsWith('javascript:') || u.startsWith('vbscript:')) return false;
   if (u.startsWith('data:')) return attr === 'src' && u.startsWith('data:image/');
   if (/^[a-z][a-z0-9+.-]*:/.test(u)) return /^(https?:|mailto:|tel:)/.test(u);
@@ -176,3 +183,13 @@ export const VIEW_COMPONENTS: ReadonlyArray<ViewTagSpec> = [
 
 /** The default renderer's full allow-list (primitives + components). */
 export const DEFAULT_VIEW_TAGS: ReadonlyArray<ViewTagSpec> = [...VIEW_PRIMITIVES, ...VIEW_COMPONENTS];
+
+/**
+ * Count element + text nodes in a view tree (the `nodeCount` a `present_view`
+ * tool reports). Single source of truth: core's parser and the plugin-view tool
+ * both import this rather than re-implementing the recursion.
+ */
+export function countNodes(node: ViewNode): number {
+  if (node.kind === 'text') return 1;
+  return 1 + node.children.reduce((sum, child) => sum + countNodes(child), 0);
+}