-
diff --git a/scripts/collect-frontend-coverage.js b/scripts/collect-frontend-coverage.js
index c950475d8..7fc95a3d2 100644
--- a/scripts/collect-frontend-coverage.js
+++ b/scripts/collect-frontend-coverage.js
@@ -792,6 +792,9 @@ async function run() {
if (typeof miniMarkdown === 'function') {
miniMarkdown('**bold** and *italic* and `code`');
miniMarkdown('[link](https://example.com)');
+ // #368 — both arms of the link-destination scheme check
+ miniMarkdown('[rel](/nodes) [frag](#/map)');
+ miniMarkdown('[bad](javascript:void0) [bad2](data:text/plain;base64,QQ==)');
miniMarkdown('- item1\n- item2\n- item3');
miniMarkdown('');
miniMarkdown(null);
diff --git a/test-all.sh b/test-all.sh
index eb0b5755e..fbd6d06f9 100755
--- a/test-all.sh
+++ b/test-all.sh
@@ -198,6 +198,7 @@ run test-reach-rank.js
run test-issue-1107-live-layout.js
run test-issue-1619-feed-detail-card-draggable.js
run test-xss-escape-sinks.js
+run test-issue-368-minimarkdown-links.js
run test-issue-393-slowpath-doc-bound.js
run test-preflight-xss-gate.js
run test-issue-1648-m4-emoji-scan.js
diff --git a/test-issue-368-minimarkdown-links.js b/test-issue-368-minimarkdown-links.js
new file mode 100644
index 000000000..ae880eaa1
--- /dev/null
+++ b/test-issue-368-minimarkdown-links.js
@@ -0,0 +1,257 @@
+/**
+ * test-issue-368-minimarkdown-links.js
+ *
+ * Issue #368 — miniMarkdown() (public/roles.js) built its anchors with
+ * .replace(/\[([^\]]+)\]\(([^)]+)\)/g,
+ * '$1')
+ * The surrounding text had already been & < > escaped, but the captured
+ * destination went into a double-quoted href with neither attribute escaping
+ * nor any restriction on the URL scheme. Home checklist/step text is
+ * site-customization content (importable, therefore untrusted) and is fed to
+ * miniMarkdown() by public/home.js, so a crafted destination could add its
+ * own attributes or use an executable scheme.
+ *
+ * These tests drive the REAL miniMarkdown from public/roles.js in a vm
+ * sandbox and assert on the produced HTML string. The browser-level
+ * counterpart (does anything actually execute on the Home page) is
+ * test-xss-368-home-links-e2e.js.
+ *
+ * Mutants this file must catch (verified by hand, see the PR):
+ * M1 drop the escapeAttr() on the destination -> A1 red
+ * M2 drop the control/whitespace stripping -> A2 red
+ * M3 accept every scheme -> A2 red
+ * M4 go back to the '$2' replacement template -> A1 red
+ */
+'use strict';
+const vm = require('vm');
+const fs = require('fs');
+const assert = require('assert');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+ try { fn(); passed++; console.log(' ✅ ' + name); }
+ catch (e) { failed++; console.log(' ❌ ' + name + ': ' + e.message); }
+}
+
+// --- Load public/roles.js the way index.html does -----------------------
+function loadRoles() {
+ const ctx = {
+ window: { addEventListener: () => {}, dispatchEvent: () => {} },
+ document: {
+ readyState: 'complete',
+ createElement: () => ({ id: '', textContent: '', innerHTML: '', style: {} }),
+ head: { appendChild: () => {} },
+ getElementById: () => null,
+ addEventListener: () => {},
+ querySelectorAll: () => [],
+ querySelector: () => null,
+ },
+ console, Date, Math, JSON, RegExp, Error, TypeError,
+ parseInt, parseFloat, isNaN, isFinite,
+ encodeURIComponent, decodeURIComponent,
+ setTimeout: () => {}, clearTimeout: () => {},
+ localStorage: { getItem: () => null, setItem: () => {}, removeItem: () => {} },
+ location: { hash: '' },
+ navigator: {},
+ fetch: () => Promise.resolve({ json: () => Promise.resolve({}) }),
+ };
+ vm.createContext(ctx);
+ vm.runInContext(fs.readFileSync('public/roles.js', 'utf8'), ctx);
+ return ctx.window;
+}
+const W = loadRoles();
+const md = W.miniMarkdown;
+assert(typeof md === 'function', 'public/roles.js did not export window.miniMarkdown');
+
+// Names of the attributes a browser would see on the first anchor. Parsing
+// the tag (rather than string-matching the payload) is what makes the
+// quote-breakout assertions payload-independent.
+function anchorAttrs(html) {
+ const m = /
- one
- two
- see { + const html = md('[ok](https://a.example/) and [no](javascript:void0)'); + assert(html.includes(' { + assert.strictEqual(typeof W.escapeAttr, 'function'); + assert.strictEqual(W.escapeAttr('a"b\'c'), 'a"b'c'); + }); + test('home.js has no second escapeAttr implementation', () => { + const src = fs.readFileSync('public/home.js', 'utf8'); + const m = /function escapeAttr\(s\) \{([^\n]*)\n/.exec(src); + assert(m, 'escapeAttr not found in public/home.js'); + assert(/return window\.escapeAttr\(s\);/.test(m[1]), + 'public/home.js defines its own escapeAttr body again: ' + m[1].trim()); + }); +} + +console.log('\n' + passed + ' passed, ' + failed + ' failed'); +process.exit(failed ? 1 : 0); diff --git a/test-xss-368-home-links-e2e.js b/test-xss-368-home-links-e2e.js new file mode 100644 index 000000000..7079f9a7c --- /dev/null +++ b/test-xss-368-home-links-e2e.js @@ -0,0 +1,266 @@ +// test-xss-368-home-links-e2e.js +// +// Browser regression test for issue #368 — miniMarkdown() link destinations +// in the REAL Home rendering path. +// +// public/home.js feeds the Home "Getting on the mesh" steps and the FAQ +// checklist through window.miniMarkdown() (public/roles.js) and assigns the +// result with innerHTML. Both come from site-customization content +// (SITE_CONFIG.home, served by /api/config/theme and importable), so the +// Markdown link destination is attacker-reachable. Before the fix the +// destination went into `href="$2"` with no attribute escaping and no scheme +// check, so it could close the attribute and add an event handler, or use +// javascript: / data:. +// +// The hostile customization is injected by rewriting /api/config/theme in the +// browser with page.route — the fixture DB is untouched and no payload leaves +// the machine. The checks are DOM-level and payload-independent: +// * did any injected handler run (window.__xss368) or any dialog open +// * does any anchor the checklist rendered resolve to an unsafe scheme +// (per the live HTMLAnchorElement.protocol a browser computed, not a +// string match on the source) +// * do the rendered anchors carry exactly the four attributes miniMarkdown +// is supposed to emit, and no inline event handler +// * do safe https / http / relative / fragment links still render, still +// point where they were told to, and still navigate +// +// Usage: BASE_URL=http://localhost:13581 node test-xss-368-home-links-e2e.js +'use strict'; +const { chromium } = require('playwright'); + +const BASE = process.env.BASE_URL || 'http://localhost:13581'; + +// Group 1 — destinations that try to close href="…" and add their own +// attributes. These stay links (they carry no scheme), but the quotes must +// come out entity-encoded so the anchor gains nothing. No payload in this +// file contains ')': miniMarkdown's destination group is [^)]+, so a ')' +// would end the destination early and truncate the payload before it ever +// reached the href. +const BREAKOUT_DESTS = [ + '" onmouseover="window.__xss368=1', + '" autofocus onfocus="window.__xss368=1', + '" onerror="window.__xss368=1" x="', + "/a' onmouseover='window.__xss368=1", +]; + +// Group 2 — destinations whose scheme is not on the allowlist, including +// ones obfuscated with case and with ASCII controls/whitespace that a +// browser ignores when it resolves a scheme. These must not become links at +// all; the label survives as plain text. +const UNSAFE_SCHEME_DESTS = [ + 'javascript:window.__xss368=1', + 'JaVaScRiPt:window.__xss368=1', + 'java\u0000script:window.__xss368=1', + 'java\tscript:window.__xss368=1', + ' javascript:window.__xss368=1', + 'data:text/html;base64,PHNjcmlwdD53aW5kb3cuX194c3MzNjg9MTwvc2NyaXB0Pg==', + 'vbscript:msgbox1', +]; + +// Group 3 — safe destinations that must keep working exactly as before. +const SAFE_DESTS = [ + 'https://meshcore.example/docs', + 'http://meshcore.example/docs', + '/nodes', + '#/map', +]; + +// Steps carry groups 1 and 3, the FAQ checklist carries group 2 — both go +// through miniMarkdown() on the same render pass. +const STEP_DESTS = BREAKOUT_DESTS.concat(SAFE_DESTS); +const HOSTILE_HOME = { + heroTitle: 'CoreScope', + heroSubtitle: 'issue #368 fixture', + steps: STEP_DESTS.map((d, i) => ({ + emoji: '', + title: 'Step ' + i, + description: 'see [xss368-step-' + i + '](' + d + ') now', + })), + checklist: UNSAFE_SCHEME_DESTS.map((d, i) => ({ + question: 'Question ' + i, + answer: 'see [xss368-scheme-' + i + '](' + d + ') now', + })), +}; + +let passed = 0, failed = 0; +async function step(name, fn) { + try { await fn(); passed++; console.log(' ✓ ' + name); } + catch (e) { failed++; console.error(' ✗ ' + name + ': ' + e.message); } +} +function assert(c, m) { if (!c) throw new Error(m || 'assertion failed'); } + +async function hostileHomePage(browser) { + const ctx = await browser.newContext({ viewport: { width: 1400, height: 900 } }); + await ctx.route((url) => url.pathname === '/api/config/theme', async (route) => { + const res = await route.fetch(); + let body = {}; + try { body = await res.json(); } catch (e) { body = {}; } + body.home = HOSTILE_HOME; + await route.fulfill({ response: res, json: body }); + }); + const page = await ctx.newPage(); + page.setDefaultTimeout(15000); + page.on('pageerror', (e) => console.error(' [pageerror]', e.message)); + page._dialogs = 0; + page.on('dialog', (d) => { page._dialogs++; d.dismiss().catch(() => {}); }); + return { ctx, page }; +} + +(async () => { + let browser; + try { + browser = await chromium.launch(); + } catch (e) { + if (process.env.CHROMIUM_REQUIRE === '1') { + console.error('Chromium required but unavailable: ' + e.message); + process.exit(1); + } + console.log('⚠️ Chromium unavailable, skipping: ' + e.message); + process.exit(0); + } + + const { ctx, page } = await hostileHomePage(browser); + await page.goto(BASE + '/#/home', { waitUntil: 'domcontentloaded' }); + // A context with no 'meshcore-user-level' gets the experience chooser + // first; the checklist section only renders for the "I'm new" level. + await page.locator('#chooseNew').click(); + // The checklist is rendered from SITE_CONFIG.home, which lands after + // /api/config/theme resolves, so wait for our own fixture text. + await page.waitForFunction( + () => /xss368-step-0/.test(document.body.textContent || ''), + null, { timeout: 15000 }); + // Give any injected timer/handler a tick to fire before we count. + await page.waitForTimeout(300); + + console.log('\n=== #368 — hostile Home Markdown link destinations ==='); + + await step('both payload groups actually reached the checklist', async () => { + const seen = await page.evaluate(() => ({ + bodies: document.querySelectorAll('.home-checklist .checklist-a').length, + text: document.body.textContent || '', + })); + const want = STEP_DESTS.length + UNSAFE_SCHEME_DESTS.length; + assert(seen.bodies === want, 'rendered ' + seen.bodies + ' checklist bodies, want ' + want); + assert(seen.text.includes('xss368-scheme-0'), 'scheme payloads never rendered'); + }); + + await step('no injected handler ran and no dialog opened', async () => { + const fired = await page.evaluate(() => window.__xss368 || 0); + assert(fired === 0, 'injected handler fired ' + fired + ' time(s)'); + assert(page._dialogs === 0, page._dialogs + ' dialog(s) opened'); + }); + + await step('no checklist anchor resolves to an unsafe scheme', async () => { + const bad = await page.evaluate(() => Array.from( + document.querySelectorAll('.home-checklist a')) + .map(a => ({ proto: a.protocol, raw: a.getAttribute('href') || '' })) + .filter(x => !['http:', 'https:'].includes(x.proto)) + .map(x => x.proto + ' ' + x.raw)); + assert(bad.length === 0, 'unsafe anchors: ' + JSON.stringify(bad)); + }); + + await step('every unsafe-scheme destination degraded to plain label text', async () => { + const rows = await page.evaluate((n) => { + const out = []; + for (let i = 0; i < n; i++) { + const label = 'xss368-scheme-' + i; + out.push({ + label, + anchored: Array.from(document.querySelectorAll('.home-checklist a')) + .some(a => (a.textContent || '').trim() === label), + present: (document.body.textContent || '').includes(label), + }); + } + return out; + }, UNSAFE_SCHEME_DESTS.length); + const anchored = rows.filter(r => r.anchored).map(r => r.label); + assert(anchored.length === 0, 'unsafe destinations became links: ' + anchored.join(', ')); + const missing = rows.filter(r => !r.present).map(r => r.label); + assert(missing.length === 0, 'label text was dropped entirely: ' + missing.join(', ')); + }); + + await step('no checklist anchor grew an attribute miniMarkdown does not emit', async () => { + const extra = await page.evaluate(() => { + const allowed = ['href', 'target', 'rel', 'style']; + const out = []; + document.querySelectorAll('.home-checklist .checklist-a a').forEach((a) => { + const names = Array.from(a.attributes).map(x => x.name.toLowerCase()); + const unexpected = names.filter(n => !allowed.includes(n)); + if (unexpected.length) out.push(a.outerHTML.slice(0, 160) + ' -> ' + unexpected.join(',')); + }); + return out; + }); + assert(extra.length === 0, 'unexpected attributes: ' + JSON.stringify(extra)); + }); + + await step('no element the checklist rendered carries an inline event handler', async () => { + const handlers = await page.evaluate(() => { + const out = []; + document.querySelectorAll('.home-checklist, .home-checklist *').forEach((el) => { + Array.from(el.attributes || []).forEach((at) => { + if (/^on/i.test(at.name)) out.push(el.tagName + '[' + at.name + ']'); + }); + }); + return out; + }); + assert(handlers.length === 0, 'inline handlers: ' + JSON.stringify(handlers)); + }); + + await step('quote-breakout destinations stay inert inside the href value', async () => { + const rows = await page.evaluate((dests) => dests.map((d, i) => { + const label = 'xss368-step-' + i; + const a = Array.from(document.querySelectorAll('.home-checklist .checklist-a a')) + .find(x => (x.textContent || '').trim() === label); + return { label, found: !!a, href: a ? a.getAttribute('href') : null, want: d }; + }), BREAKOUT_DESTS); + for (const r of rows) { + assert(r.found, r.label + ' did not render (a schemeless destination stays a link)'); + // The whole payload is still exactly one attribute VALUE: nothing + // escaped into attribute position. + assert(r.href === r.want, r.label + ' href is ' + JSON.stringify(r.href) + + ', want ' + JSON.stringify(r.want)); + } + }); + + console.log('\n=== #368 — safe Home Markdown links still work ==='); + + await step('every safe destination still renders as an anchor with the given href', async () => { + const rows = await page.evaluate((args) => args.dests.map((d, i) => { + const label = 'xss368-step-' + (args.offset + i); + const a = Array.from(document.querySelectorAll('.home-checklist .checklist-a a')) + .find(x => (x.textContent || '').trim() === label); + return { + label, + found: !!a, + href: a ? a.getAttribute('href') : null, + target: a ? a.getAttribute('target') : null, + rel: a ? a.getAttribute('rel') : null, + want: d, + }; + }), { dests: SAFE_DESTS, offset: BREAKOUT_DESTS.length }); + for (const r of rows) { + assert(r.found, r.label + ' did not render as a link'); + assert(r.href === r.want, r.label + ' href is ' + r.href + ', want ' + r.want); + assert(r.target === '_blank', r.label + ' lost target="_blank"'); + assert(r.rel === 'noopener', r.label + ' lost rel="noopener"'); + } + }); + + await step('a safe hash link still navigates', async () => { + const label = 'xss368-step-' + (STEP_DESTS.length - 1); // the '#/map' one + await page.evaluate((l) => { + const a = Array.from(document.querySelectorAll('.home-checklist .checklist-a a')) + .find(x => (x.textContent || '').trim() === l); + a.removeAttribute('target'); // keep the navigation in this tab + a.click(); + }, label); + await page.waitForFunction(() => location.hash === '#/map', null, { timeout: 10000 }); + assert((await page.evaluate(() => location.hash)) === '#/map', 'hash link did not navigate'); + }); + + await ctx.close(); + await browser.close(); + + console.log('\n' + passed + ' passed, ' + failed + ' failed'); + process.exit(failed ? 1 : 0); +})().catch((e) => { console.error(e); process.exit(1); });
b c'));
+ test('angle brackets escaped', () => assert.strictEqual(md(''), '<b>'));
+ test('ampersand escaped', () => assert.strictEqual(md('a & b'), 'a & b'));
+ test('line break', () => assert.strictEqual(md('a\nb'), 'ab')); + test('list wrapping', () => { + assert.strictEqual(md('- one\n- two\n'), '