larvit/adf-codec
3
0
Fork 0
mirror of https://github.com/larvit/adf-codec.git synced 2026-11-12 11:48:29 +01:00
Code Activity

Settle that HTML writes a URL as the ADF holds it, a scheme filter left for a later security addition

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-10-26 21:05:33 +01:00
committed by Lillem4n
parent 240c39a468
commit f9e57d4c51
3 changed files with 13 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decisions.md
+9 -5
View File
@@ -840,15 +840,19 @@ that, JavaScriptCore throws `Out of memory`, which is `engine-limit` (§Which co
## HTML writes a URL as the ADF holds it, whatever its scheme
2026-10-23, the maintainer. Goal 1. Valid until `todo.md` item 142 weighs the alternatives.
2026-10-23, the maintainer; weighed against a filter 2026-10-26. Goal 1. Valid until a security
addition filters schemes.
`adfToHtml` writes every URL exactly as the ADF holds it, escaped as every attribute value is,
`javascript:`, `vbscript:`, `file:` and `data:` included. That covers a link's `href`, an image's
`src`, and the `href` of each link the carry element shows: a carried node's link mark, a card's
`url` or `data.url`, and an external image's `url`. Carrying such a link or image, to leave the URL
out of the HTML as cmark does by default, was proposed and not taken; item 142 weighs it against
writing the URL. Carrying alone would not keep the URL out, since the carry element links what it
shows: the carry would also have to drop the shown `href`.
`url` or `data.url`, and an external image's `url`. The markdown writers do the same.
Keeping such a URL out of the visible HTML, in `data-adf` alone, as cmark does by default, was
weighed and not taken: it would make the carry show a link without its target, make `htmlToAdf`
restore the URL from `data-adf`, and need a scheme list the library keeps current. Sanitizing HTML
from an author a consumer does not trust stays the consumer's, as the README says. The maintainer
left a scheme filter for a later security addition.
## Nothing recurses unbounded
docs/reading-cost.md
+4
View File
@@ -482,3 +482,7 @@ Read most (opens and searches):
## Reading cost, chunk f305730665ab, finished 2026-10-23T10:31:43Z
78044 new input tokens before the first commit.
## Reading cost, chunk d0fc10fb69af, finished 2026-10-26T12:21:13Z
504845 new input tokens before the first commit.
todo.md
-19
View File
@@ -12,7 +12,6 @@
| ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 142 | 0.3.0 | | security | **Settle in `docs/decisions.md`, weighing the pros and cons with the maintainer, whether `adfToHtml` writes a `javascript:`, `vbscript:`, `file:` or non-image `data:` URL as the ADF holds it, in a link's `href`, an image's `src` and each link the carry element shows.** | 2 | 2 | 2 | 4 | 3 | 6 by 3 | 4.5 |
| 131 | 0.3.0 | | | **Ship `htmlToAdf`, reading back exactly what `adfToHtml` writes and refusing any other HTML as `unmappable-html`.** | 4 | 1 | 2 | 5 | 7 | 3 by 3 | 0.6 |
| 133 | 0.3.0 | 131 | decision | **Write mentions, emoji, dates, statuses and inline cards as semantic HTML in `adfToHtml` and read them back in `htmlToAdf`, in place of the carry element.** | 2 | 2 | 2 | 4 | 4 | 6 by 3 | 3.0 |
| 132 | 0.3.0 | 131 | | **Write tables as `<table>` in `adfToHtml` and read them back in `htmlToAdf`, in place of the carry element.** | 2 | 2 | 2 | 4 | 5 | 6 by 4 | 2.4 |
@@ -65,24 +64,6 @@
## Details
### 142. Settle in `docs/decisions.md`, weighing the pros and cons with the maintainer, whether `adfToHtml` writes a `javascript:`, `vbscript:`, `file:` or non-image `data:` URL as the ADF holds it, in a link's `href`, an image's `src` and each link the carry element shows.
The exposure: ADF from an author a consumer does not trust can hold a `javascript:…` URL in a
link's `href`, an external image's `url`, or a card's `url` or `data.url`. `adfToHtml` writes it as
held into a link's `href` or an image's `src`, and into the `href` of each link the carry element
shows: a carried node's link mark, a card and an external image (`docs/decisions.md` §HTML writes a
URL as the ADF holds it, whatever its scheme). An export tool showing that HTML unsanitized in a
browser runs the script when a reader follows the link.
Weigh writing the URL as held, leaving sanitizing to the consumer as for any HTML, against keeping
it in `data-adf` alone. Carrying the node no longer does that, since the carry element links what
it shows: the carry would also have to show such a link without its `href`. cmark, the CommonMark
reference implementation, leaves `javascript:`, `vbscript:`, `file:` and `data:` other than a PNG,
GIF, JPEG or WebP image out of its HTML by default; a browser reads a scheme after dropping tabs,
line breaks and leading control characters. Say whether the markdown writers' links follow the
same rule. Ask the maintainer with the pros and cons, and record the answer in place of that
decision.
### 131. Ship `htmlToAdf`, reading back exactly what `adfToHtml` writes and refusing any other HTML as `unmappable-html`.
A hand-written HTML tokenizer, linear in the input, its nesting bounded (`docs/decisions.md`