Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf605a9c

Browse files
authored
fix(isURL): handle possible bypass with URL-encoded content (#2633)
* fix(isURL): handle possible bypass with URL-encoded content* style: fix indentation
1 parenta165ebe commitf605a9c

File tree

2 files changed

+9
-2
lines changed

2 files changed

+9
-2
lines changed

‎src/lib/isURL.js‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,12 @@ export default function isURL(url, options) {
126126
constvalid_auth_regex=/^[a-zA-Z0-9\-_.%:]*$/;
127127
constis_valid_auth=valid_auth_regex.test(before_at);
128128

129-
if(is_valid_auth){
129+
// Check if this contains URL-encoded content that could be malicious
130+
// For example: #"diff-1ced9bbbf98fe2779af1d618687cec44dd27ac19c72c7cc6d85da8b67978ce90-129-131-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">
131+
// The encoded part decodes to: alert(1)
132+
consthas_encoded_content=/%[0-9a-fA-F]{2}/.test(before_at);
133+
134+
if(is_valid_auth&&!has_encoded_content){
130135
// This looks like authentication (e.g., user:password@host), not a protocol
131136
if(options.require_protocol){
132137
returnfalse;
@@ -135,6 +140,7 @@ export default function isURL(url, options) {
135140
// Don't consume the colon; let the auth parsing handle it later
136141
}else{
137142
// This looks like a malicious protocol (e.g., #"diff-1ced9bbbf98fe2779af1d618687cec44dd27ac19c72c7cc6d85da8b67978ce90-137-143-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">
143+
// or URL-encoded protocol handler (e.g., #"diff-1ced9bbbf98fe2779af1d618687cec44dd27ac19c72c7cc6d85da8b67978ce90-138-144-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">138
144
url=cleanUpProtocol(potential_protocol);
139145

140146
if(url===false){

‎test/validators.test.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,6 @@ describe('Validators', () => {
426426
'http://1337.com',
427427
// TODO: those probably should not be marked as valid URLs; CVE-2025-56200
428428
/* eslint-disable no-script-url */
429-
'#"diff-0e926933c509ce75fa4197bf85e6383c40c0d7bc207fe1fc6ae712c4cecbe18a-430-429-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">430
429
'http://evil-site.com@example.com/',
431430
'ｊａｖａｓｃｒｉｐｔ:alert(1)@example.com',
432431
/* eslint-enable no-script-url */
@@ -480,6 +479,8 @@ describe('Validators', () => {
480479
'#"diff-0e926933c509ce75fa4197bf85e6383c40c0d7bc207fe1fc6ae712c4cecbe18a-481-480-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">481
480
'#"diff-0e926933c509ce75fa4197bf85e6383c40c0d7bc207fe1fc6ae712c4cecbe18a-482-481-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">482
481
'#"diff-0e926933c509ce75fa4197bf85e6383c40c0d7bc207fe1fc6ae712c4cecbe18a-482-482-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">
482+
'#"diff-0e926933c509ce75fa4197bf85e6383c40c0d7bc207fe1fc6ae712c4cecbe18a-482-483-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">
483+
'#"diff-0e926933c509ce75fa4197bf85e6383c40c0d7bc207fe1fc6ae712c4cecbe18a-483-484-0" data-selected="false" role="gridcell" tabindex="-1" valign="top">483
484
'data:text/html,<script>alert(1)</script>@example.com',
484485
'vbscript:msgbox("XSS")@example.com',
485486
'//evil-site.com/path@example.com',

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp