render-url.mjs

Functions

Imports

It imports no other module of this repo. Imported by render-nomath.mjs, render-safe.mjs.

Source

1// The URL allowlist lives at the render layer so one guard binds every writer: a site's build, its save path and Carrel's preview all
2// call render. Pure predicates: rehypeUrlProtocols in render-nomath.mjs applies them to the rendered tree, and assertSafe applies them to the
3// output.
4
5const ALLOWED_PROTOCOLS = new Set(["https:", "http:", "mailto:"]);
6
7/**
8 * Browsers drop tab and newline anywhere in a URL, so java<TAB>script: is live. Every C0 control and DEL goes, stricter than the
9 * spec, which can only block more: a NUL left in makes the scheme look relative.
10 *
11 * @param {string} raw
12 * @returns {string}
13 */
14function normalizeForProtocolTest(raw) {
15  let out = "";
16  for (const character of raw) {
17    const code = character.codePointAt(0) ?? 0;
18    if (code <= 0x20 || code === 0x7f) continue;
19    // U+FFFD is what markdown makes of a NUL in a link destination; removing it exposes a hidden scheme.
20    if (code === 0xfffd) continue;
21    out += character;
22  }
23  return out.toLowerCase();
24}
25
26/**
27 * @param {string} value
28 * @returns {string | null}
29 */
30function protocolOf(value) {
31  const match = /^([a-z][a-z0-9+.-]*):/.exec(normalizeForProtocolTest(value));
32  return match ? `${match[1]}:` : null;
33}
34
35/**
36 * @param {string} value
37 * @returns {string}
38 */
39function decodeOrSelf(value) {
40  try {
41    return decodeURIComponent(value);
42  } catch {
43    return value;
44  }
45}
46
47/**
48 * Schemeless means relative and is allowed: footnotes and heading autolinks are fragments. The decoded form must pass too, so a
49 * percent-encoded scheme cannot be smuggled past.
50 *
51 * @param {string} value
52 * @returns {boolean}
53 */
54export function isAllowedUrl(value) {
55  for (const form of [value, decodeOrSelf(value)]) {
56    const protocol = protocolOf(form);
57    if (protocol !== null && !ALLOWED_PROTOCOLS.has(protocol)) return false;
58  }
59  return true;
60}