fix(contacts): sanitize company website href to block stored XSS #136

Merged

David merged 2 commits from fix/mapps-149-sanitize-website-href into main

2026-06-14 15:57:08 +02:00

David commented

2026-06-14 15:39:06 +02:00

Owner

The company detail page rendered the user-supplied website value straight into an anchor href, so a value like javascript:alert(1) executed attacker-controlled script in the authenticated origin when clicked (stored XSS, token theft via sessionStorage). React-style text escaping does not cover URL values placed in href.

Add safe_href to utils::url: it allowlists URL schemes (http, https, mailto) and rejects javascript:, data:, vbscript: and any other explicit scheme, ignoring case and embedded whitespace/control bytes that browsers strip before resolving the scheme. The company website now renders a live link only when the value passes safe_href, falling back to plain text otherwise, and the target="_blank" anchor gains rel="noopener noreferrer" to close the reverse-tabnabbing gap.

Unit tests cover the dangerous schemes, case/whitespace evasion, safe schemes, blank input, and scheme-less relative references.

#MAPPS-149

The company detail page rendered the user-supplied `website` value straight into an anchor `href`, so a value like `javascript:alert(1)` executed attacker-controlled script in the authenticated origin when clicked (stored XSS, token theft via sessionStorage). React-style text escaping does not cover URL values placed in `href`. Add `safe_href` to `utils::url`: it allowlists URL schemes (`http`, `https`, `mailto`) and rejects `javascript:`, `data:`, `vbscript:` and any other explicit scheme, ignoring case and embedded whitespace/control bytes that browsers strip before resolving the scheme. The company website now renders a live link only when the value passes `safe_href`, falling back to plain text otherwise, and the `target="_blank"` anchor gains `rel="noopener noreferrer"` to close the reverse-tabnabbing gap. Unit tests cover the dangerous schemes, case/whitespace evasion, safe schemes, blank input, and scheme-less relative references. #MAPPS-149

David added 1 commit

2026-06-14 15:39:06 +02:00

fix(contacts): sanitize company website href to block stored XSS

Check / clippy + fmt + tests (pull_request) Successful in 2m47s

Details

51a813c94d

The company detail page rendered the user-supplied `website` value straight into an anchor `href`, so a value like `javascript:alert(1)` executed attacker-controlled script in the authenticated origin when clicked (stored XSS, token theft via sessionStorage). React-style text escaping does not cover URL values placed in `href`.

Add `safe_href` to `utils::url`: it allowlists URL schemes (`http`, `https`, `mailto`) and rejects `javascript:`, `data:`, `vbscript:` and any other explicit scheme, ignoring case and embedded whitespace/control bytes that browsers strip before resolving the scheme. The company website now renders a live link only when the value passes `safe_href`, falling back to plain text otherwise, and the `target="_blank"` anchor gains `rel="noopener noreferrer"` to close the reverse-tabnabbing gap.

Unit tests cover the dangerous schemes, case/whitespace evasion, safe schemes, blank input, and scheme-less relative references.

#MAPPS-149

David added 1 commit

2026-06-14 15:57:04 +02:00

Merge branch 'main' into fix/mapps-149-sanitize-website-href

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / clippy + fmt + tests (pull_request) Successful in 1m16s

Details

40dd637a91