Skip to content

Unify handling of URIs with schemes that are not in the whitelist. #2068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
gmilde wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Unify handling of URIs with schemes that are not in the whitelist. #2068

gmilde wants to merge 2 commits into from

Conversation

@gmilde
Copy link
Contributor

@gmilde gmilde commented Dec 9, 2025

Treat "off-list" schemes as part of a local wiki item name, so that page names like "Parrots: blue or green" are easy to access.

Add check for safe URI scheme to Docbook.
Don't drop the link text in HTML.
Don't downcase the name in Markdown.
Link to local wiki item instead of a silly error in rST.

Closes issue #2028.

The following test page shows the rendering of unsafe URIs as well as legitimate page names under various markup formats:

= URI scheme whitelist =

Moin implements a whitelist of approved URI schemes.
If a given URI has an off-list schem, converters (except Mediawiki) 
now treat it as a wiki-local URI reference and link to local item:
 
Moin Wiki: [[javascript:alert%28'hi'%29|click here]],
[[Canada: Nature and Culture]], 
[[Canada: Nature and Culture|Canada]]

[[http:Home]]
 
{{{#!creole
Creole: [[javascript:alert%28'hi'%29|click here]],
[[Canada: Nature and Culture]], 
[[Canada: Nature and Culture|Canada]]

}}}

{{{#!markdown
Markdown: [click here] [id] or [here](javascript:alert%28'hi'%29).
See the page on [Canada](Canada: Nature and Culture).

[id]: javascript:alert('hi')
}}}

{{{#!rst
reStructuredText: `click here <javascript:alert('hi')>`__.
See the pages on `Canada: Nature and Culture`_.
Standalone: <javascript:alert('hi')>, javascript:alert%28'hi'%29.
}}}

{{{#!html
<html>
<p>
HTML: <a href="javascript:alert%28'hi'%29">click here</a>
      <a href="http:Home">Home</a>
      <a href="Canada: Nature and Culture">Canada</a>
</p>
</html>
}}}

{{{#!docbook
<article xmlns='http://docbook.org/ns/docbook' xmlns:xlink='http://www.w3.org/1999/xlink'>
<para>
 DokBook link: <link xlink:href="javascript:alert('hi')">click here</link>,
 <link xlink:href="Canada: Nature and Culture">Canada</link>.
 (Problematic "olinks" are silently ignored: 
 <olink targetdoc="http://example.org/" targetptr="Intro">click here</olink>,
 <olink targetdoc="javascript:alert('hi')">click here</olink>,
 <olink targetdoc="Canada: Nature and Culture">Canada</olink>,
 <olink targetdoc="Canada: Nature and Culture" targetptr="Intro">Canada Intro</olink>.)
</para>
</article>
}}}


{{{#!mediawiki
Mediawiki: uses different syntax for external vs. internal links:
* external links with off-list schemes are not recognized as link syntax  [javascript:alert('hi') click here] vs. [http://example.org/help example link] 
* internal links always get the "wiki.local" pseudo-scheme: [[Canada: Nature and Culture|Canada]], [[http://jedmodes.sf.net Jedmodes]]
}}}

@gmilde
Unify handling of URIs with schemes that are not in the whitelist.
525d737 
Treat "off-list" schemes as part of a local wiki item name, so that page names
like "Parrots: blue or green" are easy to access.

Add check for safe URI scheme to Docbook.
Don't drop the link text in HTML.
Don't downcase the name in Markdown.
Link to local wiki item instead of a silly error in rST.

Closes [issue#2028].
@gmilde
Copy link
Contributor Author

gmilde commented Dec 9, 2025

TODO: Currently, there are only pytest test cases for rST. Once the desired handling is agreed, add test cases for the other converters.

@gmilde
Adapt test of "html_in"-converter to new handling of "off-list" URI s…
ec47b70 
…chemes.

Use triple quotes for test string also in test_rst_in.py.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gmilde