8da69e0f77
## Summary
- Fixes **GHSA-7w89-7q26-gj7q**: stored XSS via `javascript:` URIs in
BlockNote `FileBlock` `props.url`, rendered as a clickable `<a href>`.
- Audited the full codebase and hardened **all** surfaces where
user-controlled URLs are rendered as `href` or passed to `window.open`.
- Applies defense-in-depth: server-side input validation + client-side
render-time checks + lint rules to prevent regressions.
### Changes
**New utility** — `isSafeUrl` (`~/utils/isSafeUrl.ts`):
Allowlists `http:`, `https:`, `mailto:`, `tel:` protocols and relative
paths (`/`). Returns `false` for `javascript:`, `data:`, `vbscript:`,
etc.
**Server-side** — `validateBlocknoteFieldOrThrow`:
- Recursively walks all blocks and validates `props.url` and inline link
`href` values
- Rejects payloads with unsafe URL protocols at save time (before data
is stored)
**Client-side** — 8 components hardened:
| Component | Fix |
|-----------|-----|
| `FileBlock` (reported vuln) | `isSafeUrl` gate, fixed
`target="__blank"` → `_blank`, added `rel="noopener noreferrer"` |
| `LazyMarkdownRenderer` | `isSafeUrl` gate on markdown `<a href>`,
added `target`/`rel` |
| `EditLinkPopover` (TipTap) | Validates + auto-prefixes `https://`,
rejects unsafe URLs |
| `LinkBubbleMenu` (TipTap) | `isSafeUrl` gate on `window.open`, added
`noopener,noreferrer` |
| `AttachmentRow` | `isSafeUrl` gate on file attachment `href` |
| `URLDisplay` / `LinkDisplay` | `isSafeUrl` as second check after
`startsWith('http')` |
| `IframeWidget` | `isSafeUrl` gate on `src`, shows error state for
unsafe URLs |
| `InformationBannerMaintenance` | `isSafeUrl` gate on `window.open` |
**Lint rules** — `.oxlintrc.json`:
- `no-script-url: error` — catches `javascript:` string literals
- `react/jsx-no-script-url: error` — catches `javascript:` in JSX href
attributes
## Test plan
- [ ] Create a note via GraphQL mutation with `"url":
"javascript:void(alert(1))"` in a file block — should be rejected by
server validation
- [ ] Verify existing file attachments in notes still render and are
clickable
- [ ] Verify TipTap link insertion works for normal `https://` URLs
- [ ] Verify TipTap link insertion rejects `javascript:` URIs
- [ ] Verify markdown links in AI chat render correctly for safe URLs
- [ ] Verify URL/Link field displays still work for normal URLs
- [ ] Verify iframe widget rejects non-http(s) URLs
Made with [Cursor](https://cursor.com)
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
219 lines
15 KiB
TypeScript
219 lines
15 KiB
TypeScript
/*
|
|
* _____ _
|
|
*|_ _|_ _____ _ __ | |_ _ _
|
|
* | | \ \ /\ / / _ \ '_ \| __| | | | Auto-generated file
|
|
* | | \ V V / __/ | | | |_| |_| | Any edits to this will be overridden
|
|
* |_| \_/\_/ \___|_| |_|\__|\__, |
|
|
* |___/
|
|
*/
|
|
|
|
export { applyDiff } from './applyDiff';
|
|
export { compareArraysOfObjectsByProperty } from './array/compareArraysOfObjectsByProperty';
|
|
export { filterDuplicatesById } from './array/filterDuplicatesById';
|
|
export { filterOutByProperty } from './array/filterOutByProperty';
|
|
export { findById } from './array/findById';
|
|
export { findByProperty } from './array/findByProperty';
|
|
export { findOrThrow } from './array/findOrThrow';
|
|
export { getContiguousIncrementalValues } from './array/getContiguousIncrementalValues';
|
|
export { isNonEmptyArray } from './array/isNonEmptyArray';
|
|
export { mapById } from './array/mapById';
|
|
export { mapByProperty } from './array/mapByProperty';
|
|
export { sumByProperty } from './array/sumByProperty';
|
|
export { upsertIntoArrayOfObjectsComparingId } from './array/upsertIntoArrayOfObjectsComparingId';
|
|
export { upsertPropertiesOfItemIntoArrayOfObjectsComparingId } from './array/upsertPropertiesOfItemIntoArrayOfObjectsComparingId';
|
|
export { assertUnreachable } from './assertUnreachable';
|
|
export { base64UrlEncode } from './base64UrlEncode';
|
|
export { conditionalAvailabilityParser } from './command-menu-items/conditionalAvailabilityParser';
|
|
export { evaluateConditionalAvailabilityExpression } from './command-menu-items/evaluateConditionalAvailabilityExpression';
|
|
export { interpolateCommandMenuItemTemplate } from './command-menu-items/interpolateCommandMenuItemTemplate';
|
|
export { resolveObjectMetadataLabel } from './command-menu-items/resolveObjectMetadataLabel';
|
|
export { safeGetNestedProperty } from './command-menu-items/safeGetNestedProperty';
|
|
export { computeDiffBetweenObjects } from './compute-diff-between-objects';
|
|
export { isPlainDateAfter } from './date/isPlainDateAfter';
|
|
export { isPlainDateBefore } from './date/isPlainDateBefore';
|
|
export { isPlainDateBeforeOrEqual } from './date/isPlainDateBeforeOrEqual';
|
|
export { isPlainDateInSameMonth } from './date/isPlainDateInSameMonth';
|
|
export { isPlainDateInWeekend } from './date/isPlainDateInWeekend';
|
|
export { isSamePlainDate } from './date/isSamePlainDate';
|
|
export { parseToPlainDateOrThrow } from './date/parseToPlainDateOrThrow';
|
|
export { sortPlainDate } from './date/sortPlainDate';
|
|
export { turnJSDateToPlainDate } from './date/turnJSDateToPlainDate';
|
|
export { turnPlainDateIntoUserTimeZoneInstantString } from './date/turnPlainDateIntoUserTimeZoneInstantString';
|
|
export { turnPlainDateToShiftedDateInSystemTimeZone } from './date/turnPlainDateToShiftedDateInSystemTimeZone';
|
|
export { deepMerge } from './deepMerge';
|
|
export { CustomError } from './errors/CustomError';
|
|
export { evalFromContext } from './evalFromContext';
|
|
export { extractAndSanitizeObjectStringFields } from './extractAndSanitizeObjectStringFields';
|
|
export { computeMorphRelationFieldName } from './fieldMetadata/compute-morph-relation-field-name';
|
|
export { isFieldMetadataArrayKind } from './fieldMetadata/isFieldMetadataArrayKind';
|
|
export { isFieldMetadataDateKind } from './fieldMetadata/isFieldMetadataDateKind';
|
|
export { isFieldMetadataEligibleForFieldsWidget } from './fieldMetadata/isFieldMetadataEligibleForFieldsWidget';
|
|
export { isFieldMetadataNumericKind } from './fieldMetadata/isFieldMetadataNumericKind';
|
|
export { isFieldMetadataSelectKind } from './fieldMetadata/isFieldMetadataSelectKind';
|
|
export { isFieldMetadataTextKind } from './fieldMetadata/isFieldMetadataTextKind';
|
|
export { extractFolderPathFilenameAndTypeOrThrow } from './files/extractFolderPathFilenameAndTypeOrThrow.util';
|
|
export { checkIfShouldComputeEmptinessFilter } from './filter/checkIfShouldComputeEmptinessFilter';
|
|
export { computeGqlOperationFilterForEmails } from './filter/compute-record-gql-operation-filter/for-composite-field/computeGqlOperationFilterForEmails';
|
|
export { computeGqlOperationFilterForLinks } from './filter/compute-record-gql-operation-filter/for-composite-field/computeGqlOperationFilterForLinks';
|
|
export { computeEmptyGqlOperationFilterForEmails } from './filter/computeEmptyGqlOperationFilterForEmails';
|
|
export { computeEmptyGqlOperationFilterForLinks } from './filter/computeEmptyGqlOperationFilterForLinks';
|
|
export { computeRecordGqlOperationFilter } from './filter/computeRecordGqlOperationFilter';
|
|
export type { DateTimePeriod } from './filter/dates/types/DateTimePeriod';
|
|
export { addUnitToDateTime } from './filter/dates/utils/addUnitToDateTime';
|
|
export { addUnitToZonedDateTime } from './filter/dates/utils/addUnitToZonedDateTime';
|
|
export { convertCalendarStartDayNonIsoNumberToFirstDayOfTheWeek } from './filter/dates/utils/convertCalendarStartDayNonIsoNumberToFirstDayOfTheWeek';
|
|
export { convertFirstDayOfTheWeekToCalendarStartDayNumber } from './filter/dates/utils/convertFirstDayOfTheWeekToCalendarStartDayNumber';
|
|
export type { FirstDayOfTheWeekSchema } from './filter/dates/utils/firstDayOfWeekSchema';
|
|
export { firstDayOfWeekSchema } from './filter/dates/utils/firstDayOfWeekSchema';
|
|
export { getFirstDayOfTheWeekAsANumberForDateFNS } from './filter/dates/utils/getFirstDayOfTheWeekAsANumberForDateFNS';
|
|
export { getFirstDayOfTheWeekAsISONumber } from './filter/dates/utils/getFirstDayOfTheWeekAsISONumber';
|
|
export {
|
|
FIRST_DAY_OF_WEEK_ISO_8601_MONDAY,
|
|
getNextPeriodStart,
|
|
} from './filter/dates/utils/getNextPeriodStart';
|
|
export { getPeriodStart } from './filter/dates/utils/getPeriodStart';
|
|
export { relativeDateFilterAmountSchema } from './filter/dates/utils/relativeDateFilterAmountSchema';
|
|
export type { RelativeDateFilterDirection } from './filter/dates/utils/relativeDateFilterDirectionSchema';
|
|
export { relativeDateFilterDirectionSchema } from './filter/dates/utils/relativeDateFilterDirectionSchema';
|
|
export type { RelativeDateFilter } from './filter/dates/utils/relativeDateFilterSchema';
|
|
export { relativeDateFilterSchema } from './filter/dates/utils/relativeDateFilterSchema';
|
|
export { relativeDateFilterStringifiedSchema } from './filter/dates/utils/relativeDateFilterStringifiedSchema';
|
|
export type { RelativeDateFilterUnit } from './filter/dates/utils/relativeDateFilterUnitSchema';
|
|
export { relativeDateFilterUnitSchema } from './filter/dates/utils/relativeDateFilterUnitSchema';
|
|
export type { ResolvedDateFilterValue } from './filter/dates/utils/resolveDateFilter';
|
|
export { resolveDateFilter } from './filter/dates/utils/resolveDateFilter';
|
|
export type { ResolvedDateTimeFilterValue } from './filter/dates/utils/resolveDateTimeFilter';
|
|
export { resolveDateTimeFilter } from './filter/dates/utils/resolveDateTimeFilter';
|
|
export { resolveRelativeDateFilter } from './filter/dates/utils/resolveRelativeDateFilter';
|
|
export { resolveRelativeDateFilterStringified } from './filter/dates/utils/resolveRelativeDateFilterStringified';
|
|
export { resolveRelativeDateTimeFilter } from './filter/dates/utils/resolveRelativeDateTimeFilter';
|
|
export { resolveRelativeDateTimeFilterStringified } from './filter/dates/utils/resolveRelativeDateTimeFilterStringified';
|
|
export { subUnitFromDateTime } from './filter/dates/utils/subUnitFromDateTime';
|
|
export { subUnitFromZonedDateTime } from './filter/dates/utils/subUnitFromZonedDateTime';
|
|
export { filterOutInvalidRecordFilters } from './filter/filterOutInvalidRecordFilters';
|
|
export { isEmptinessOperand } from './filter/isEmptinessOperand';
|
|
export { isRecordFilterOperandExpectingValue } from './filter/isRecordFilterOperandExpectingValue';
|
|
export { isRecordFilterValueValid } from './filter/isRecordFilterValueValid';
|
|
export { turnAnyFieldFilterIntoRecordGqlFilter } from './filter/turnAnyFieldFilterIntoRecordGqlFilter';
|
|
export type {
|
|
RecordFilter,
|
|
RecordFilterGroup,
|
|
} from './filter/turnRecordFilterGroupIntoGqlOperationFilter';
|
|
export { turnRecordFilterGroupsIntoGqlOperationFilter } from './filter/turnRecordFilterGroupIntoGqlOperationFilter';
|
|
export { turnRecordFilterIntoRecordGqlOperationFilter } from './filter/turnRecordFilterIntoGqlOperationFilter';
|
|
export { combineFilters } from './filter/utils/combineFilters';
|
|
export { convertViewFilterOperandToCoreOperand } from './filter/utils/convert-view-filter-operand-to-core-operand.util';
|
|
export { convertViewFilterValueToString } from './filter/utils/convertViewFilterValueToString';
|
|
export { createAnyFieldRecordFilterBaseProperties } from './filter/utils/createAnyFieldRecordFilterBaseProperties';
|
|
export {
|
|
convertGreaterThanOrEqualRatingToArrayOfRatingValues,
|
|
convertLessThanOrEqualRatingToArrayOfRatingValues,
|
|
convertRatingToRatingValue,
|
|
} from './filter/utils/fieldRatingConvertors';
|
|
export { filterSelectOptionsOfFieldMetadataItem } from './filter/utils/filterSelectOptionsOfFieldMetadataItem';
|
|
export { generateILikeFiltersForCompositeFields } from './filter/utils/generateILikeFiltersForCompositeFields';
|
|
export { getEmptyRecordGqlOperationFilter } from './filter/utils/getEmptyRecordGqlOperationFilter';
|
|
export { getFilterTypeFromFieldType } from './filter/utils/getFilterTypeFromFieldType';
|
|
export { isExpectedSubFieldName } from './filter/utils/isExpectedSubFieldName';
|
|
export { isMatchingArrayFilter } from './filter/utils/isMatchingArrayFilter';
|
|
export { isMatchingBooleanFilter } from './filter/utils/isMatchingBooleanFilter';
|
|
export { isMatchingCurrencyFilter } from './filter/utils/isMatchingCurrencyFilter';
|
|
export { isMatchingDateFilter } from './filter/utils/isMatchingDateFilter';
|
|
export { isMatchingFilesFilter } from './filter/utils/isMatchingFilesFilter';
|
|
export { isMatchingFloatFilter } from './filter/utils/isMatchingFloatFilter';
|
|
export { isMatchingMultiSelectFilter } from './filter/utils/isMatchingMultiSelectFilter';
|
|
export { isMatchingRatingFilter } from './filter/utils/isMatchingRatingFilter';
|
|
export { isMatchingRawJsonFilter } from './filter/utils/isMatchingRawJsonFilter';
|
|
export { isMatchingRichTextFilter } from './filter/utils/isMatchingRichTextFilter';
|
|
export { isMatchingSelectFilter } from './filter/utils/isMatchingSelectFilter';
|
|
export { isMatchingStringFilter } from './filter/utils/isMatchingStringFilter';
|
|
export { isMatchingTSVectorFilter } from './filter/utils/isMatchingTSVectorFilter';
|
|
export { isMatchingUUIDFilter } from './filter/utils/isMatchingUUIDFilter';
|
|
export { arrayOfStringsOrVariablesSchema } from './filter/utils/validation-schemas/arrayOfStringsOrVariablesSchema';
|
|
export { arrayOfUuidOrVariableSchema } from './filter/utils/validation-schemas/arrayOfUuidsOrVariablesSchema';
|
|
export {
|
|
relationFilterValueSchemaObject,
|
|
jsonRelationFilterValueSchema,
|
|
} from './filter/utils/validation-schemas/jsonRelationFilterValueSchema';
|
|
export { formatToShortNumber } from './format/formatToShortNumber';
|
|
export { fromArrayToUniqueKeyRecord } from './from-array-to-unique-key-record.util';
|
|
export { fromArrayToValuesByKeyRecord } from './fromArrayToValuesByKeyRecord.util';
|
|
export { getURLSafely } from './getURLSafely';
|
|
export {
|
|
getNodeTypename,
|
|
getConnectionTypename,
|
|
getEdgeTypename,
|
|
getGroupByConnectionTypename,
|
|
} from './graphql/graphql-get-typename.util';
|
|
export { getImageAbsoluteURI } from './image/getImageAbsoluteURI';
|
|
export {
|
|
sanitizeURL,
|
|
getLogoUrlFromDomainName,
|
|
} from './image/getLogoUrlFromDomainName';
|
|
export { getUniqueConstraintsFields } from './indexMetadata/getUniqueConstraintsFields';
|
|
export { isAutoSelectModelId } from './isAutoSelectModelId';
|
|
export { fastDeepEqual } from './json/fast-deep-equal';
|
|
export { getAppPath } from './navigation/getAppPath';
|
|
export { getSettingsPath } from './navigation/getSettingsPath';
|
|
export { parseJson } from './parseJson';
|
|
export { removePropertiesFromRecord } from './removePropertiesFromRecord';
|
|
export { removeUndefinedFields } from './removeUndefinedFields';
|
|
export { resolveRichTextVariables } from './rich-text-variable-resolver';
|
|
export { safeParseRelativeDateFilterJSONStringified } from './safeParseRelativeDateFilterJSONStringified';
|
|
export { getGenericOperationName } from './sentry/getGenericOperationName';
|
|
export { getHumanReadableNameFromCode } from './sentry/getHumanReadableNameFromCode';
|
|
export { appendCopySuffix } from './strings/appendCopySuffix';
|
|
export { camelToKebab } from './strings/camelToKebab';
|
|
export { camelToSnakeCase } from './strings/camelToSnakeCase';
|
|
export { capitalize } from './strings/capitalize';
|
|
export { kebabToCamelCase } from './strings/kebabToCamelCase';
|
|
export { pascalCase } from './strings/pascalCase';
|
|
export { pascalToKebab } from './strings/pascalToKebab';
|
|
export { stringifySafely } from './strings/stringifySafely';
|
|
export { uncapitalize } from './strings/uncapitalize';
|
|
export type {
|
|
TipTapMarkType,
|
|
TipTapNodeType,
|
|
LinkMarkAttributes,
|
|
TipTapMark,
|
|
} from './tiptap/tiptap-marks';
|
|
export {
|
|
TIPTAP_MARK_TYPES,
|
|
TIPTAP_NODE_TYPES,
|
|
TIPTAP_MARKS_RENDER_ORDER,
|
|
} from './tiptap/tiptap-marks';
|
|
export type { StringPropertyKeys } from './trim-and-remove-duplicated-whitespaces-from-object-string-properties';
|
|
export { trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties } from './trim-and-remove-duplicated-whitespaces-from-object-string-properties';
|
|
export { trimAndRemoveDuplicatedWhitespacesFromString } from './trim-and-remove-duplicated-whitespaces-from-string';
|
|
export { isMetadataGqlOperationSignature } from './typeguard/isMetadataGqlOperationSignature';
|
|
export { isPlainObject } from './typeguard/isPlainObject';
|
|
export { isRecordGqlOperationSignature } from './typeguard/isRecordGqlOperationSignature';
|
|
export { throwIfNotDefined } from './typeguard/throwIfNotDefined';
|
|
export { absoluteUrlSchema } from './url/absoluteUrlSchema';
|
|
export { buildSignedPath } from './url/buildSignedPath';
|
|
export { ensureAbsoluteUrl } from './url/ensureAbsoluteUrl';
|
|
export { getAbsoluteUrlOrThrow } from './url/getAbsoluteUrlOrThrow';
|
|
export { getSafeUrl } from './url/getSafeUrl';
|
|
export { getUrlHostnameOrThrow } from './url/getUrlHostnameOrThrow';
|
|
export { isSafeUrl } from './url/isSafeUrl';
|
|
export { isValidHostname } from './url/isValidHostname';
|
|
export { isValidUrl } from './url/isValidUrl';
|
|
export { normalizeUrl } from './url/normalizeUrl';
|
|
export { normalizeUrlOrigin } from './url/normalizeUrlOrigin';
|
|
export { safeDecodeURIComponent } from './url/safeDecodeURIComponent';
|
|
export { uuidToBase36 } from './uuidToBase36';
|
|
export { assertIsDefinedOrThrow } from './validation/assertIsDefinedOrThrow';
|
|
export { isDefined } from './validation/isDefined';
|
|
export { isEmptyObject } from './validation/isEmptyObject';
|
|
export { isLabelIdentifierFieldMetadataTypes } from './validation/isLabelIdentifierFieldMetadataTypes';
|
|
export type { SearchableFieldType } from './validation/isSearchableFieldType';
|
|
export { isSearchableFieldType } from './validation/isSearchableFieldType';
|
|
export { isValidLocale } from './validation/isValidLocale';
|
|
export { isValidTwentySubdomain } from './validation/isValidTwentySubdomain';
|
|
export { isValidUuid } from './validation/isValidUuid';
|
|
export { isValidVariable } from './validation/isValidVariable';
|
|
export { normalizeLocale } from './validation/normalizeLocale';
|
|
export { getCountryCodesForCallingCode } from './validation/phones-value/getCountryCodesForCallingCode';
|
|
export { isValidCountryCode } from './validation/phones-value/isValidCountryCode';
|
|
export { resolveInput } from './variable-resolver';
|