sandrodachandClaude Opus 5.5
b2ecda9896
MindSift CI & Docker Release / Build, Test in Container & Push (push) Successful in 1m48s
safeHref lets only http, https and mailto become links (Markdown viewer, outliner, legal links); javascript: and friends show as text. A middleware sets a Content-Security-Policy (scripts only from MindSift, no framing, connections only to this server), X-Frame-Options, nosniff, Referrer-Policy and a Permissions-Policy. The two inline scripts of index.html moved to files so script-src stays 'self'. The second inline script also deleted every cache on each page load, which undermined the offline start; it is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 lines
747 B
TypeScript
17 lines
747 B
TypeScript
// Links from user content (notes, task notes, Markdown) may only point to web pages or mail addresses.
|
||
// Anything else – javascript:, data:, vbscript:, file: and friends – would run or load in the app's
|
||
// context when clicked, so it is shown as plain text instead (FLAW-28).
|
||
const ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']);
|
||
|
||
export function safeHref(raw: string): string | null {
|
||
const value = raw.trim();
|
||
if (!value) return null;
|
||
try {
|
||
// Browsers ignore control characters and whitespace inside the scheme ("java\tscript:"); URL does the same
|
||
const url = new URL(value);
|
||
return ALLOWED_PROTOCOLS.has(url.protocol) ? url.href : null;
|
||
} catch {
|
||
return null; // relative or broken: not a link
|
||
}
|
||
}
|