etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-28 09:33:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): инлайновые regex-барьеры для CodeQL в openAppScheme и redirect.html

Browse Source 
Хелпер-функции (isSafeToOpen/isSafeAppLink) CodeQL как санитайзеры не
распознаёт — js/xss и js/client-side-unvalidated-url-redirection
продолжали флаговаться на sink'ах. Проверки перенесены инлайн к sink'ам
как префикс-якорные RegExp-гарды (распознаваемый барьер): scheme://
обязателен, javascript/data/vbscript/file/blob/about/intent/content/
filesystem (и http для redirect.html) отбрасываются. Семантика та же.
This commit is contained in:
Fringg
2026-07-25 00:32:00 +03:00
parent aa6bf44db9
commit 51d0f0431a
2 changed files with 20 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
public/miniapp/redirect.html
View File

@@ -129,19 +129,21 @@
// `file:` URI (DOM-XSS) is not scheme://-shaped, and http(s)/intent
// are blocked (open redirect / intent abuse) — so only VPN app
// schemes (happ://, vless://, ...) pass. Mirrors the validation in
// src/pages/DeepLinkRedirect.tsx.
function isSafeAppLink(raw) {
var s = String(raw || '').trim().toLowerCase();
var m = s.match(/^([a-z][a-z0-9+.\-]*):\/\//);
if (!m) return false;
var blocked = ['http', 'https', 'file', 'blob', 'about', 'javascript', 'data', 'vbscript', 'intent', 'content'];
return blocked.indexOf(m[1]) === -1;
}
if (!url || !isSafeAppLink(url)) {
// src/pages/DeepLinkRedirect.tsx. Both checks are INLINE
// prefix-anchored RegExp tests so CodeQL recognizes them as taint
// barriers (js/xss, js/client-side-unvalidated-url-redirection).
function showNoUrl() {
document.getElementById('title').textContent = t.noUrl;
document.getElementById('subtitle').textContent = '';
document.querySelector('.spinner').style.display = 'none';
}
if (!url || !/^[a-z][a-z0-9+.\-]*:\/\//i.test(url)) {
showNoUrl();
return;
}
if (/^(https?|file|blob|about|javascript|data|vbscript|intent|content|filesystem):/i.test(url)) {
showNoUrl();
return;
}