Handling of URI schemes outside the "allowed" URI_SCHEMES #2028
Description
The input converters differ in their handling of URI references
with a scheme that is not in the set of "allowed URI schemes"
moin.constants.misc.URI_SCHEMES.
-
The wiki markups (creole, mediawiki, moinwiki) treat schemes outside of the set as part of a page name, so
javascript:alert('xss')becomeswiki.local:javascript:alert%28'xss'%29. -
Markdown happily links to all given URIs - including silly and dangerous ones like
javascript:ornew item: orange. -
HTML and DocBook turn links to URIs with "unregistered" schemes into simple text. (via
converters._util.allowed_uri_scheme()).
This prevents dangerous links – but also legitimate use of wiki item names containing a colon. -
rST displays a box with a "stop-x" icon and the link text but no explanation, URL or offending scheme.
I plan to improve the rST handling, but wonder whether I should
a) treat unknown schemes as part of an item name (as in wiki markup) or
b) display a proper error message (with reason for failure, error location, full offending URI).
- The first alternative is simpler to implement, consistent with current handling in wiki markup converters and preferable if there is a wiki item with a name containing a colon.
- The second alternative is more explicit and verbose. Links to a local wiki item with a colon in the name would have to be prepended with the "wiki.local" scheme.
Adding "wiki.local" to the supported schemes in moin.constants.misc.URI_SCHEMES would also help with links to pages with colon in the name in HTML and DocBook markup.