u2ui 1.5.15 → 1.5.16

package/js/rte/src/sanitize/README.md

@@ -38,8 +38,13 @@ Event attributes, comments, and data attributes
 are not enabled by default. Inline `style` is: it executes nothing, and where
 foreign presentation is unwanted the Unstyle policy already removes it from what
 an import brought — a policy that must not carry it at all narrows `attributes`.
-Relative URLs use the explicit `relative` protocol token. Known URL attributes
-without a matching protocol rule are removed rather than accepted implicitly.
+A URL that resolves inside the document — `/page`, `page.html`, `#anchor`,
+`?q=1` — passes wherever the attribute has a rule at all. It reaches nowhere the
+document is not, so there is nothing for a policy to allow and nothing an
+application can forbid by forgetting to name it. `//host/x` and `\\host/x` name no
+scheme either but resolve elsewhere: they are absolute URLs in disguise, judged
+as the `http`/`https` ones they turn into. Known URL attributes without a
+matching protocol rule are removed rather than accepted implicitly.
 
 `policy.with(options)` copies a policy with single axes replaced, and
 `policyFor(config, base)` is what a host gets: its own `--u2-rte-elements`,
@@ -52,7 +57,7 @@ returns the base itself.
 const policy = new SanitizePolicy({
     elements: ['p', 'a', 'strong'],
     attributes: {'*': ['class'], a: ['href', 'rel']},
-    protocols: {a: {href: ['https', 'relative']}},
+    protocols: {a: {href: ['https']}},
 });
 ```
 
@@ -127,6 +132,20 @@ through `--u2-rte-classes`; external HTML then cannot smuggle in classes the
 host does not know, and the same list drives the style control and presentation
 cleanup.
 
+## Possible extensions
+
+Neither is planned; both are written down because the protocol list invites them
+and answers neither.
+
+- **A host allowlist.** A protocol list says `https` is fine and cannot say
+  *whose* `https`. An application that wants its own images and no foreign
+  tracking pixel has no way to state it here, and stating it as a protocol —
+  which an earlier `relative` token tried — describes the wrong axis.
+- **Reading the document's CSP.** `img-src`, `media-src` and `frame-src` already
+  declare what the page will load at all. An editor that read them would stop
+  offering what the browser is about to refuse, without a second list to keep in
+  step.
+
 ## TODO
 
 - Add contextual parsing for table and list insertion sites.

package/js/rte/src/sanitize/policy.js

@@ -20,14 +20,14 @@ const DEFAULT_ATTRIBUTES = Object.freeze({
     time: Object.freeze(['datetime']),
 });
 const DEFAULT_PROTOCOLS = Object.freeze({
-    a: Object.freeze({href: Object.freeze(['http', 'https', 'mailto', 'relative', 'tel'])}),
-    blockquote: Object.freeze({cite: Object.freeze(['http', 'https', 'relative'])}),
+    a: Object.freeze({href: Object.freeze(['http', 'https', 'mailto', 'tel'])}),
+    blockquote: Object.freeze({cite: Object.freeze(['http', 'https'])}),
     // `data:` belongs to an image and to nothing else here: an image executes
     // nothing, not even an SVG one, which browsers draw in a script-free
     // context. In a navigating attribute the same protocol is a page, so `a`
     // and the citations keep it out.
-    img: Object.freeze({src: Object.freeze(['data', 'http', 'https', 'relative'])}),
-    q: Object.freeze({cite: Object.freeze(['http', 'https', 'relative'])}),
+    img: Object.freeze({src: Object.freeze(['data', 'http', 'https'])}),
+    q: Object.freeze({cite: Object.freeze(['http', 'https'])}),
 });
 
 // Elements a browser never renders the children of. Unwrapping one turns source — a stylesheet, a
@@ -84,8 +84,7 @@ export class SanitizePolicy {
         const protocols = this.#protocols[element.localName.toLowerCase()]?.[attributeName]
             || this.#protocols['*']?.[attributeName];
         if (!protocols) return false;
-        const protocol = urlProtocol(value, base);
-        return protocol !== null && protocols.includes(protocol);
+        return allowedUrl(value, base, protocols);
     }
 
     // Reduces a subtree to the elements this policy allows, keeping the content
@@ -217,14 +216,17 @@ function protocolGroups(value) {
     return Object.freeze(result);
 }
 
-function urlProtocol(value, base) {
-    const input = String(value).trim();
-    const compact = input.replace(/[\u0000-\u0020]/g, '');
-    if (!/^[a-z][a-z\d+.-]*:/i.test(compact)) return 'relative';
+// A url naming no scheme that lands on the document's own origin — `/page`, `#anchor`, `?q=1` —
+// reaches nowhere the document is not: nothing to allow, and nothing to forbid by forgetting to
+// name it. `//host` and `\\host` name none either but go elsewhere, so their real scheme decides.
+function allowedUrl(value, base, protocols) {
+    const input = String(value).trim().replace(/[\u0000-\u0020]/g, '');
+    const own = !/^([a-z][a-z\d+.-]*:|[/\\]{2})/i.test(input);
     try {
-        return new URL(input, base).protocol.slice(0, -1).toLowerCase();
+        const url = new URL(input, base);
+        return own ? url.origin === new URL(base).origin : protocols.includes(url.protocol.slice(0, -1));
     } catch {
-        return null;
+        return own; // nothing to resolve against — an opaque document keeps its own urls
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u2ui",
-  "version": "1.5.15",
+  "version": "1.5.16",
   "description": "HTML Advanced: More Capabilities, Same Feel, Same Simplicity",
   "keywords": ["web-components","pattern-library","component-library","ui-toolkit","design-system"],
   "author": "Tobias Buschor",