From b4cebe9891eee673fb68e62e61850ea16e74a68f Mon Sep 17 00:00:00 2001
From: Essential Randomness <essentialrandomn3ss@gmail.com>
Date: Mon, 20 Jul 2026 02:10:36 -0700
Subject: [PATCH] Guard external content link schemes

Validate external content URLs before rendering them as links. Permit supported web schemes while rejecting unsafe or malformed destinations. Render every guarded link through a shared SafeExternalLink component and keep link behavior consistent across posts, events, and shared content.
---
 src/components/SafeExternalLink.astro         |  39 ++++++
 src/components/content/PostCard.astro         |   5 +-
 .../content/ShareableContentList.astro        |  17 ++-
 src/components/events/EventCard.astro         |  17 ++-
 src/lib/community/shared-content.ts           |  82 +++++++++---
 src/lib/shared-content.test.ts                | 119 ++++++++++++++++++
 6 files changed, 248 insertions(+), 31 deletions(-)
 create mode 100644 src/components/SafeExternalLink.astro
 create mode 100644 src/lib/shared-content.test.ts

diff --git a/src/components/SafeExternalLink.astro b/src/components/SafeExternalLink.astro
new file mode 100644
index 0000000..06d3eb7
--- /dev/null
+++ b/src/components/SafeExternalLink.astro
@@ -0,0 +1,39 @@
+---
+import { toSafeExternalHref } from "../lib/community/shared-content";
+
+interface Props {
+  href: string | null | undefined;
+  /** Tried under the same safety rules when href is rejected. */
+  fallbackHref?: string | null;
+  /** What to render when no safe destination exists. */
+  fallbackTag?: "span" | "div" | "none";
+  /** Announce the new tab to screen readers inside the link. */
+  announceNewTab?: boolean;
+  class?: string;
+}
+
+const {
+  href,
+  fallbackHref,
+  fallbackTag = "span",
+  announceNewTab = false,
+  class: className,
+} = Astro.props;
+
+const safeHref = toSafeExternalHref(href, { fallback: fallbackHref });
+const Tag = safeHref ? "a" : fallbackTag === "none" ? null : fallbackTag;
+const linkAttributes = safeHref
+  ? { href: safeHref, rel: "noopener noreferrer", target: "_blank" }
+  : {};
+---
+
+{
+  Tag && (
+    <Tag class={className} {...linkAttributes}>
+      <slot />
+      {safeHref && announceNewTab && (
+        <span class="visually-hidden"> (opens in new tab)</span>
+      )}
+    </Tag>
+  )
+}
diff --git a/src/components/content/PostCard.astro b/src/components/content/PostCard.astro
index b65e55c..19f7242 100644
--- a/src/components/content/PostCard.astro
+++ b/src/components/content/PostCard.astro
@@ -1,5 +1,6 @@
 ---
 import Avatar, { type AvatarSource } from "../Avatar.astro";
+import SafeExternalLink from "../SafeExternalLink.astro";
 
 interface Props {
   title: string;
@@ -47,7 +48,7 @@ const communityHue = hueFromString(source);
 ---
 
 <article class="post-card">
-  <a href={url} class="post-card__link" rel="noopener noreferrer" target="_blank">
+  <SafeExternalLink href={url} class="post-card__link" fallbackTag="div">
     <Avatar
       avatar={author.avatar}
       size={36}
@@ -76,7 +77,7 @@ const communityHue = hueFromString(source);
         {tag && <span class="post-card__tag">#{tag}</span>}
       </div>
     </div>
-  </a>
+  </SafeExternalLink>
   {hasActions && (
     <div class="post-card__actions">
       <slot name="actions" />
diff --git a/src/components/content/ShareableContentList.astro b/src/components/content/ShareableContentList.astro
index fa49690..1c2f13b 100644
--- a/src/components/content/ShareableContentList.astro
+++ b/src/components/content/ShareableContentList.astro
@@ -1,6 +1,7 @@
 ---
 import type { ShareCandidateList } from '../../lib/community/share-candidates';
 import { actions } from 'astro:actions';
+import SafeExternalLink from '../SafeExternalLink.astro';
 import ShareableContentIcon from './ShareableContentIcon.astro';
 
 interface Props {
@@ -77,10 +78,9 @@ function formatDate(date: Date | undefined): string {
           <li class="share-row" data-share-row data-kind={candidate.kind} hidden={index >= initialVisible}>
             <ShareableContentIcon kind={candidate.kind} />
             <div class="share-row__main">
-              <a class="share-row__title" href={rowUrl} rel="noopener noreferrer" target="_blank">
+              <SafeExternalLink href={rowUrl} class="share-row__title" announceNewTab>
                 {candidate.title}
-                <span class="visually-hidden"> (opens in new tab)</span>
-              </a>
+              </SafeExternalLink>
               <p class="share-row__meta">
                 {candidate.date ? (
                   <time datetime={candidate.date.toISOString()}>
@@ -94,15 +94,14 @@ function formatDate(date: Date | undefined): string {
               </p>
             </div>
             <div class="share-row__actions">
-              <a
-                class="share-row__preview"
+              <SafeExternalLink
                 href={rowUrl}
-                rel="noopener noreferrer"
-                target="_blank"
+                class="share-row__preview"
+                fallbackTag="none"
+                announceNewTab
               >
                 View
-                <span class="visually-hidden"> (opens in new tab)</span>
-              </a>
+              </SafeExternalLink>
               <form method="POST" action={actions.shareAtmosphereContent}>
                 <input type="hidden" name="sourceRepo" value={repo} />
                 <input type="hidden" name="candidateUri" value={candidate.uri} />
diff --git a/src/components/events/EventCard.astro b/src/components/events/EventCard.astro
index 3bcc489..b96ae80 100644
--- a/src/components/events/EventCard.astro
+++ b/src/components/events/EventCard.astro
@@ -4,6 +4,8 @@ import EventLocation from "./EventLocation.astro";
 import CheckIcon from "./icons/CheckIcon.astro";
 import ExternalLinkIcon from "./icons/ExternalLinkIcon.astro";
 import { eventAnchorId } from "../../lib/community/happening-now";
+import { smokeSignalHref } from "../../lib/community/events";
+import SafeExternalLink from "../SafeExternalLink.astro";
 
 interface Props {
   atUri: string;
@@ -81,6 +83,7 @@ const rsvpButtonAriaLabel = isGoing
   ? `Mark yourself as not going to ${name}`
   : `Mark yourself as going to ${name}`;
 const canRsvp = showRsvp && isLoggedIn && Boolean(cid);
+const eventFallbackHref = smokeSignalHref(atUri);
 ---
 
 <article
@@ -132,7 +135,9 @@ const canRsvp = showRsvp && isLoggedIn && Boolean(cid);
     >
   </p>
   <h3 class:list={["event-card__name", `event-card__name--${titleSize}`]}>
-    <a href={uri} rel="noopener noreferrer" target="_blank">{name}</a>
+    <SafeExternalLink href={uri} fallbackHref={eventFallbackHref}>
+      {name}
+    </SafeExternalLink>
   </h3>
   <p
     class:list={["event-card__desc", !description && "event-card__desc--empty"]}
@@ -148,16 +153,16 @@ const canRsvp = showRsvp && isLoggedIn && Boolean(cid);
     >
   </div>
   <div class="event-card__actions">
-    <a
+    <SafeExternalLink
       href={uri}
+      fallbackHref={eventFallbackHref}
       class="event-card__details"
-      rel="noopener noreferrer"
-      target="_blank"
+      fallbackTag="none"
+      announceNewTab
     >
       Details
       <ExternalLinkIcon class="event-card__details-icon" />
-      <span class="visually-hidden"> (opens in new tab)</span>
-    </a>
+    </SafeExternalLink>
     {
       canRsvp ? (
         <form
diff --git a/src/lib/community/shared-content.ts b/src/lib/community/shared-content.ts
index 0da3c7a..96ba44a 100644
--- a/src/lib/community/shared-content.ts
+++ b/src/lib/community/shared-content.ts
@@ -10,6 +10,60 @@ import { normalizeEventMode, parseEventRecord } from './events.js';
 
 const LEAFLET_BASE = 'https://leaflet.pub/profile';
 
+const SAFE_WEB_SCHEMES = new Set(['http:', 'https:']);
+const HAS_OWN_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+
+export interface SafeExternalHrefOptions {
+  /** Relative path appended to the base URL once the base passes the safety check. */
+  path?: string | null;
+  /** Tried under the same safety rules when the primary value is rejected. */
+  fallback?: string | null;
+}
+
+export function toSafeExternalHref(
+  value: string | null | undefined,
+  { path, fallback }: SafeExternalHrefOptions = {},
+): string | undefined {
+  return (
+    resolveSafeExternalHref(value, path) ??
+    (fallback != null ? resolveSafeExternalHref(fallback) : undefined)
+  );
+}
+
+function resolveSafeExternalHref(
+  value: string | null | undefined,
+  path?: string | null,
+): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.startsWith('//')) return undefined;
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return undefined;
+  }
+  if (!SAFE_WEB_SCHEMES.has(url.protocol)) return undefined;
+  if (path == null) return url.toString();
+  const trimmedPath = path.trim();
+  // A path carrying its own authority or scheme would replace the base instead
+  // of extending it.
+  if (trimmedPath.startsWith('//') || HAS_OWN_SCHEME.test(trimmedPath)) {
+    return undefined;
+  }
+  const base = url.toString().endsWith('/') ? url.toString() : `${url.toString()}/`;
+  const segment = trimmedPath.startsWith('/') ? trimmedPath.slice(1) : trimmedPath;
+  try {
+    const withPath = new URL(segment, base);
+    // The URL parser strips embedded tab/newline characters, so a smuggled
+    // scheme can survive the pattern check above.
+    if (!SAFE_WEB_SCHEMES.has(withPath.protocol)) return undefined;
+    return withPath.toString();
+  } catch {
+    return undefined;
+  }
+}
+
 export interface BlogPostRef {
   title: string;
   publishedAt: Date;
@@ -61,10 +115,9 @@ function buildPostUrl(
   rkey: string,
   path: string | undefined,
 ): string {
-  if (baseUrl && path) {
-    return appendPath(baseUrl, path);
-  }
-  return `${LEAFLET_BASE}/${did}/${rkey}`;
+  const fallback = `${LEAFLET_BASE}/${did}/${rkey}`;
+  if (!path || !baseUrl) return fallback;
+  return toSafeExternalHref(baseUrl, { path, fallback }) ?? fallback;
 }
 
 export interface SharedDocumentRef {
@@ -258,30 +311,31 @@ export async function resolveStandardDocumentUrl(
   fallbackBaseUrl?: string,
 ): Promise<string> {
   const path = docValue.path as string | undefined;
+  const fallback = `${LEAFLET_BASE}/${repo}/${rkey}`;
 
   const site = typeof docValue.site === 'string' ? docValue.site : undefined;
 
-  if (site && !isValidAtUri(site) && path) return appendPath(site, path);
+  if (site && !isValidAtUri(site) && path) {
+    return toSafeExternalHref(site, { path, fallback }) ?? fallback;
+  }
 
   if (site && isValidAtUri(site)) {
     try {
       const pub = await fetchRecord(site);
       const pubUrl = pub?.url as string | undefined;
-      if (pubUrl && path) return appendPath(pubUrl, path);
+      if (pubUrl && path) {
+        return toSafeExternalHref(pubUrl, { path, fallback }) ?? fallback;
+      }
     } catch {
       // Fall through
     }
   }
 
-  if (fallbackBaseUrl && path) return appendPath(fallbackBaseUrl, path);
-
-  return `${LEAFLET_BASE}/${repo}/${rkey}`;
-}
+  if (fallbackBaseUrl && path) {
+    return toSafeExternalHref(fallbackBaseUrl, { path, fallback }) ?? fallback;
+  }
 
-function appendPath(baseUrl: string, path: string): string {
-  const base = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
-  const segment = path.startsWith('/') ? path.slice(1) : path;
-  return new URL(segment, base).toString();
+  return fallback;
 }
 
 function asNonEmptyString(value: unknown): string | undefined {
diff --git a/src/lib/shared-content.test.ts b/src/lib/shared-content.test.ts
new file mode 100644
index 0000000..559a7fc
--- /dev/null
+++ b/src/lib/shared-content.test.ts
@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  resolveStandardDocumentUrl,
+  toSafeExternalHref,
+} from './community/shared-content.js'
+
+const FALLBACK = 'https://fallback.example/'
+
+test('toSafeExternalHref accepts http and https URLs', () => {
+  assert.equal(
+    toSafeExternalHref('https://example.com/path', { fallback: FALLBACK }),
+    'https://example.com/path',
+  )
+  assert.equal(
+    toSafeExternalHref('http://example.com/path', { fallback: FALLBACK }),
+    'http://example.com/path',
+  )
+})
+
+test('toSafeExternalHref rejects javascript, data, vbscript, and file schemes', () => {
+  assert.equal(
+    toSafeExternalHref('javascript:alert(1)', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref('data:text/html,<h1>bad</h1>', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref('vbscript:MsgBox("bad")', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref('file:///etc/passwd', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+})
+
+test('toSafeExternalHref rejects scheme-relative and obfuscated links', () => {
+  assert.equal(
+    toSafeExternalHref('//example.com/path', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref(' javascript:alert(1)', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref('\tjavascript:alert(1)', { fallback: FALLBACK }),
+    FALLBACK,
+  )
+})
+
+test('toSafeExternalHref appends a relative path to a safe base', () => {
+  assert.equal(
+    toSafeExternalHref('https://example.com/blog', { path: 'post/1' }),
+    'https://example.com/blog/post/1',
+  )
+  assert.equal(
+    toSafeExternalHref('https://example.com/blog', { path: '/post/1' }),
+    'https://example.com/blog/post/1',
+  )
+})
+
+test('toSafeExternalHref rejects paths that carry their own authority or scheme', () => {
+  assert.equal(
+    toSafeExternalHref('https://example.com', {
+      path: '//evil.example/path',
+      fallback: FALLBACK,
+    }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref('https://example.com', {
+      path: 'https://evil.example/path',
+      fallback: FALLBACK,
+    }),
+    FALLBACK,
+  )
+  assert.equal(
+    toSafeExternalHref('https://example.com', {
+      path: ' javascript:alert(1)',
+      fallback: FALLBACK,
+    }),
+    FALLBACK,
+  )
+})
+
+test('resolveStandardDocumentUrl protects against absolute path override attempts', async () => {
+  const document = {
+    site: 'https://publisher.example',
+    path: '//evil.example/path',
+  } as Record<string, unknown>
+  const value = await resolveStandardDocumentUrl(
+    document,
+    'did:example:alice',
+    'rkey',
+    async () => null,
+    FALLBACK,
+  )
+  assert.equal(value, 'https://leaflet.pub/profile/did:example:alice/rkey')
+})
+
+test('resolveStandardDocumentUrl rejects javascript path values', async () => {
+  const document = {
+    site: 'https://publisher.example',
+    path: ' javascript:alert(1)',
+  } as Record<string, unknown>
+  const value = await resolveStandardDocumentUrl(
+    document,
+    'did:example:alice',
+    'rkey',
+    async () => null,
+    FALLBACK,
+  )
+  assert.equal(value, 'https://leaflet.pub/profile/did:example:alice/rkey')
+})
-- 
2.51.2