diff --git a/docs/decisions.md b/docs/decisions.md index 7086a98..f9970b9 100644 --- a/docs/decisions.md +++ b/docs/decisions.md @@ -840,15 +840,19 @@ that, JavaScriptCore throws `Out of memory`, which is `engine-limit` (§Which co ## HTML writes a URL as the ADF holds it, whatever its scheme -2026-10-23, the maintainer. Goal 1. Valid until `todo.md` item 142 weighs the alternatives. +2026-10-23, the maintainer; weighed against a filter 2026-10-26. Goal 1. Valid until a security +addition filters schemes. `adfToHtml` writes every URL exactly as the ADF holds it, escaped as every attribute value is, `javascript:`, `vbscript:`, `file:` and `data:` included. That covers a link's `href`, an image's `src`, and the `href` of each link the carry element shows: a carried node's link mark, a card's -`url` or `data.url`, and an external image's `url`. Carrying such a link or image, to leave the URL -out of the HTML as cmark does by default, was proposed and not taken; item 142 weighs it against -writing the URL. Carrying alone would not keep the URL out, since the carry element links what it -shows: the carry would also have to drop the shown `href`. +`url` or `data.url`, and an external image's `url`. The markdown writers do the same. + +Keeping such a URL out of the visible HTML, in `data-adf` alone, as cmark does by default, was +weighed and not taken: it would make the carry show a link without its target, make `htmlToAdf` +restore the URL from `data-adf`, and need a scheme list the library keeps current. Sanitizing HTML +from an author a consumer does not trust stays the consumer's, as the README says. The maintainer +left a scheme filter for a later security addition. ## Nothing recurses unbounded diff --git a/docs/reading-cost.md b/docs/reading-cost.md index 95dae7c..5f6f0fe 100644 --- a/docs/reading-cost.md +++ b/docs/reading-cost.md @@ -482,3 +482,7 @@ Read most (opens and searches): ## Reading cost, chunk f305730665ab, finished 2026-10-23T10:31:43Z 78044 new input tokens before the first commit. + +## Reading cost, chunk d0fc10fb69af, finished 2026-10-26T12:21:13Z + +504845 new input tokens before the first commit. diff --git a/todo.md b/todo.md index c8b48fc..5e8682a 100644 --- a/todo.md +++ b/todo.md @@ -12,7 +12,6 @@ | ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score | |---|---|---|---|---|---|---|---|---|---|---|---| -| 142 | 0.3.0 | | security | **Settle in `docs/decisions.md`, weighing the pros and cons with the maintainer, whether `adfToHtml` writes a `javascript:`, `vbscript:`, `file:` or non-image `data:` URL as the ADF holds it, in a link's `href`, an image's `src` and each link the carry element shows.** | 2 | 2 | 2 | 4 | 3 | 6 by 3 | 4.5 | | 131 | 0.3.0 | | | **Ship `htmlToAdf`, reading back exactly what `adfToHtml` writes and refusing any other HTML as `unmappable-html`.** | 4 | 1 | 2 | 5 | 7 | 3 by 3 | 0.6 | | 133 | 0.3.0 | 131 | decision | **Write mentions, emoji, dates, statuses and inline cards as semantic HTML in `adfToHtml` and read them back in `htmlToAdf`, in place of the carry element.** | 2 | 2 | 2 | 4 | 4 | 6 by 3 | 3.0 | | 132 | 0.3.0 | 131 | | **Write tables as `` in `adfToHtml` and read them back in `htmlToAdf`, in place of the carry element.** | 2 | 2 | 2 | 4 | 5 | 6 by 4 | 2.4 | @@ -65,24 +64,6 @@ ## Details -### 142. Settle in `docs/decisions.md`, weighing the pros and cons with the maintainer, whether `adfToHtml` writes a `javascript:`, `vbscript:`, `file:` or non-image `data:` URL as the ADF holds it, in a link's `href`, an image's `src` and each link the carry element shows. - -The exposure: ADF from an author a consumer does not trust can hold a `javascript:…` URL in a -link's `href`, an external image's `url`, or a card's `url` or `data.url`. `adfToHtml` writes it as -held into a link's `href` or an image's `src`, and into the `href` of each link the carry element -shows: a carried node's link mark, a card and an external image (`docs/decisions.md` §HTML writes a -URL as the ADF holds it, whatever its scheme). An export tool showing that HTML unsanitized in a -browser runs the script when a reader follows the link. - -Weigh writing the URL as held, leaving sanitizing to the consumer as for any HTML, against keeping -it in `data-adf` alone. Carrying the node no longer does that, since the carry element links what -it shows: the carry would also have to show such a link without its `href`. cmark, the CommonMark -reference implementation, leaves `javascript:`, `vbscript:`, `file:` and `data:` other than a PNG, -GIF, JPEG or WebP image out of its HTML by default; a browser reads a scheme after dropping tabs, -line breaks and leading control characters. Say whether the markdown writers' links follow the -same rule. Ask the maintainer with the pros and cons, and record the answer in place of that -decision. - ### 131. Ship `htmlToAdf`, reading back exactly what `adfToHtml` writes and refusing any other HTML as `unmappable-html`. A hand-written HTML tokenizer, linear in the input, its nesting bounded (`docs/decisions.md`