Files
twenty/packages/twenty-front/src/modules/advanced-text-editor/components/LinkBubbleMenu.tsx
T
Félix Malfait 8da69e0f77 Fix stored XSS via unsafe URL protocols in href attributes (#19282)
## Summary

- Fixes **GHSA-7w89-7q26-gj7q**: stored XSS via `javascript:` URIs in
BlockNote `FileBlock` `props.url`, rendered as a clickable `<a href>`.
- Audited the full codebase and hardened **all** surfaces where
user-controlled URLs are rendered as `href` or passed to `window.open`.
- Applies defense-in-depth: server-side input validation + client-side
render-time checks + lint rules to prevent regressions.

### Changes

**New utility** — `isSafeUrl` (`~/utils/isSafeUrl.ts`):  
Allowlists `http:`, `https:`, `mailto:`, `tel:` protocols and relative
paths (`/`). Returns `false` for `javascript:`, `data:`, `vbscript:`,
etc.

**Server-side** — `validateBlocknoteFieldOrThrow`:  
- Recursively walks all blocks and validates `props.url` and inline link
`href` values
- Rejects payloads with unsafe URL protocols at save time (before data
is stored)

**Client-side** — 8 components hardened:
| Component | Fix |
|-----------|-----|
| `FileBlock` (reported vuln) | `isSafeUrl` gate, fixed
`target="__blank"` → `_blank`, added `rel="noopener noreferrer"` |
| `LazyMarkdownRenderer` | `isSafeUrl` gate on markdown `<a href>`,
added `target`/`rel` |
| `EditLinkPopover` (TipTap) | Validates + auto-prefixes `https://`,
rejects unsafe URLs |
| `LinkBubbleMenu` (TipTap) | `isSafeUrl` gate on `window.open`, added
`noopener,noreferrer` |
| `AttachmentRow` | `isSafeUrl` gate on file attachment `href` |
| `URLDisplay` / `LinkDisplay` | `isSafeUrl` as second check after
`startsWith('http')` |
| `IframeWidget` | `isSafeUrl` gate on `src`, shows error state for
unsafe URLs |
| `InformationBannerMaintenance` | `isSafeUrl` gate on `window.open` |

**Lint rules** — `.oxlintrc.json`:
- `no-script-url: error` — catches `javascript:` string literals
- `react/jsx-no-script-url: error` — catches `javascript:` in JSX href
attributes

## Test plan

- [ ] Create a note via GraphQL mutation with `"url":
"javascript:void(alert(1))"` in a file block — should be rejected by
server validation
- [ ] Verify existing file attachments in notes still render and are
clickable
- [ ] Verify TipTap link insertion works for normal `https://` URLs
- [ ] Verify TipTap link insertion rejects `javascript:` URIs
- [ ] Verify markdown links in AI chat render correctly for safe URLs
- [ ] Verify URL/Link field displays still work for normal URLs
- [ ] Verify iframe widget rejects non-http(s) URLs


Made with [Cursor](https://cursor.com)

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-04 08:05:27 +02:00

68 lines
1.8 KiB
TypeScript

import { BubbleMenuIconButton } from '@/advanced-text-editor/components/BubbleMenuIconButton';
import { EditLinkPopover } from '@/advanced-text-editor/components/EditLinkPopover';
import { StyledBubbleMenuContainer } from '@/advanced-text-editor/components/TextBubbleMenu';
import { type Editor } from '@tiptap/core';
import { useEditorState } from '@tiptap/react';
import { BubbleMenu } from '@tiptap/react/menus';
import { IconExternalLink, IconLinkOff } from 'twenty-ui/display';
import { getSafeUrl } from 'twenty-shared/utils';
type LinkBubbleMenuProps = {
editor: Editor;
};
export const LinkBubbleMenu = ({ editor }: LinkBubbleMenuProps) => {
const state = useEditorState({
editor,
selector: (ctx) => {
return {
linkHref: ctx.editor.getAttributes('link').href || '',
};
},
});
const handleShouldShow = () => {
return editor.isActive('link');
};
const menuActions = [
{
Icon: IconExternalLink,
onClick: () => {
const safeHref = getSafeUrl(state.linkHref);
if (safeHref) {
window.open(safeHref, '_blank', 'noopener,noreferrer');
}
},
},
{
Icon: IconLinkOff,
onClick: () =>
editor.chain().focus().extendMarkRange('link').unsetLink().run(),
},
];
return (
<BubbleMenu
pluginKey="link-bubble-menu"
editor={editor}
shouldShow={handleShouldShow}
updateDelay={0}
>
<StyledBubbleMenuContainer>
<EditLinkPopover defaultValue={state.linkHref} editor={editor} />
{menuActions.map(({ Icon, onClick }) => {
return (
<BubbleMenuIconButton
key={Icon.name || Icon.displayName || 'unknown'}
Icon={Icon}
onClick={onClick}
/>
);
})}
</StyledBubbleMenuContainer>
</BubbleMenu>
);
};