liuyu/nofx
1
0
Fork 0
mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-14 00:07:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: sanitize markdown link URLs to prevent javascript: XSS

Browse Source 
Only allow http/https URLs in rendered markdown links. Replace any
non-http(s) URL with '#' to prevent potential javascript: URI attacks.
This commit is contained in:
shinchan-zhai
2026-03-23 09:44:32 +08:00
parent f28f0e340c
commit 2b969ee668
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/pages/AgentChatPage.tsx
View File

@@ -189,10 +189,13 @@ function renderInline(text: string): (string | JSX.Element)[] {
} else if (part.match(/^\[([^\]]+)\]\(([^)]+)\)$/)) { } else if (part.match(/^\[([^\]]+)\]\(([^)]+)\)$/)) {
const match = part.match(/^\[([^\]]+)\]\(([^)]+)\)$/) const match = part.match(/^\[([^\]]+)\]\(([^)]+)\)$/)
if (match) { if (match) {
const href = match[2]
// Only allow http/https links to prevent javascript: XSS
const safeHref = /^https?:\/\//i.test(href) ? href : '#'
result.push( result.push(
<a <a
key={i} key={i}
href={match[2]} href={safeHref}
target="_blank" target="_blank"
rel="noopener noreferrer" rel="noopener noreferrer"
style={{ color: '#F0B90B', textDecoration: 'underline', textUnderlineOffset: 2 }} style={{ color: '#F0B90B', textDecoration: 'underline', textUnderlineOffset: 2 }}