fix(system): only pass http(s) release URLs to clients #26

Merged

nalum merged 1 commit from fix/release-url-scheme into main

2026-08-13 11:38:08 +00:00

nalum commented

2026-08-13 10:08:13 +00:00

Owner

CheckForUpdate copied the feed's html_url into ReleaseUrl unvalidated, and the admin page renders it into an anchor href — a compromised feed could serve a javascript: URL.

safeReleaseURL now admits only absolute http/https URLs with a host; anything else becomes empty. Table-driven tests cover javascript:, data:, case tricks, scheme-relative, relative, empty, and unparsable inputs.

Fixes #19

🤖 Generated with Claude Code

`CheckForUpdate` copied the feed's `html_url` into `ReleaseUrl` unvalidated, and the admin page renders it into an anchor href — a compromised feed could serve a `javascript:` URL. `safeReleaseURL` now admits only absolute http/https URLs with a host; anything else becomes empty. Table-driven tests cover `javascript:`, `data:`, case tricks, scheme-relative, relative, empty, and unparsable inputs. Fixes #19 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum added 1 commit

2026-08-13 10:08:13 +00:00

fix(system): only pass http(s) release URLs to clients

check / web (push) Successful in 1m30s

Details

check / go (push) Successful in 1m45s

Details

be11cab969

The update feed's html_url was copied into ReleaseUrl unvalidated,
and the admin web page renders that value into an anchor href — a
compromised or substituted feed could serve javascript: (or data:)
and get script execution in the admin's session. A server-side
scheme allowlist (absolute http/https only, host required) closes
that off; anything else leaves ReleaseUrl empty, since a missing
link beats a hostile one.

Fixes #19

nalum force-pushed fix/release-url-scheme from be11cab969

check / web (push) Successful in 1m30s

Details

check / go (push) Successful in 1m45s

Details

to c8ead552ad

tag / tag (push) Has been cancelled

Details

check / web (push) Successful in 1m40s

Details

check / go (push) Successful in 2m3s

Details