id(web): neutralize executable URL schemes in imported Markdown links #5745

Activity

1. dezren39

   added

   kind/bugSomething isn't working (prefixed form of the classic bug label)Something isn't working (prefixed form of the classic bug label)

   priority/highImportant and time-sensitiveImportant and time-sensitive

   app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)

   on Nov 5, 2026
2. developing-today commented on Nov 5, 2026

   

   developing-todayBot

   on Nov 5, 2026 – with developing.today

   Contributor

   More actions

   CODE-1434
3. github-actions

   assigned

   dezren39

   on Nov 5, 2026
4. dezren39

   added a commit that references this issue on Nov 5, 2026

   fix(id): neutralize executable URL schemes in imported Markdown links

   ...

   This issue will close once commit 49aad00 is merged into the 'main' branch.

   49aad00
5. dezren39

   added

   queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

   task/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item

   on Nov 5, 2026
6. dezren39 commented on Nov 5, 2026

   

   dezren39

   on Nov 5, 2026

   MemberAuthor

   More actions

   🤖 Agent note · done

   • Agent: queue worker (repo-worker-code), lane code-z
   • Session / ID: task 10157
   • Found via: queue claim (assigned_lane=direct; triaged directly this shift)
   • Task: Triage of issue id(web): neutralize executable URL schemes in imported Markdown links #5745 — CONFIRMED at current main c26e0585add36770e90d7b24480b9bb5b3564c5e.
   • Expectation: done — findings below; the fix is enqueued as a follow-up small_fix task (packet hidden_files/5745-fix-packet-10157.json).
   • Links: task 10157; issue id(web): neutralize executable URL schemes in imported Markdown links #5745

   Triage findings — issue #5745 is a live stored-XSS-class bug

   Verified fresh against GitHub main c26e0585add3 (not the packet's stale line numbers alone):

   1. Verbatim href copy, no scheme check. pkgs/id/src/web/markdown.rs, NodeValue::Link arm (line 2988 at that sha): let mut attrs = json!({"href": link.url}); — the Comrak URL goes straight into the ProseMirror link mark. A grep of the full 10,821-line file finds no scheme validation or sanitizer, and a repo code search for safe_scheme / allowed_schemes / sanitize_url / is_safe_url returns no hits anywhere.
   2. Emit side is the same. At ~4972–4984 the save path builds <a href="..."> from linkHref with escape_attr_value only — attribute escaping stops quote-breakout, not a javascript: scheme.
   3. Collab path reaches it. pkgs/id/src/web/collab.rs (~141–153): ContentMode::Markdown => markdown_to_prosemirror(&text) — collaborative Markdown uses the same unsanitized converter, exactly as the issue states.
   4. Test gap is real. The renderer tests at ~5831–5901 assert https://, http://, and mailto: hrefs only; there is no javascript: / data: / vbscript: case in markdown.rs.
   5. No competing work. gh pr list --search 5745 (all states) returns nothing; the issue carries no held / user/owned / do-not-merge / do-not-auto-edit labels.

   Routing: fix scoped as a single allowed-scheme sanitizer (oracle: http, https, mailto, and scheme-less relative/internal references; protocol-relative decided and documented explicitly; every other scheme neutralized by dropping the href while keeping the link text), applied on both parse and emit paths so all Markdown entry points share it, with the acceptance-criteria test matrix from the issue body. Enqueued as a small_fix follow-up task — see the task 10157 completion for its task id.
7. dezren39

   added

   task/small-fixQueue packet kind: bounded fix with reproduction and targeted testsQueue packet kind: bounded fix with reproduction and targeted tests

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   and removed

   queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

   on Nov 5, 2026
8. developing-today commented on Nov 5, 2026

   

   developing-todayBot

   on Nov 5, 2026 – with developing.today

   Contributor

   More actions

   🤖 Agent note · picked up

   • Agent: queue worker (repo-worker-code), lane code-d
   • Session / ID: task 10643
   • Found via: queue claim
   • Task: Fix issue id(web): neutralize executable URL schemes in imported Markdown links #5745 — neutralize executable URL schemes in id web Markdown links (allowed-scheme sanitizer). Assigned lane=direct, working it directly.
   • Revalidation: issue id(web): neutralize executable URL schemes in imported Markdown links #5745 OPEN fresh, no hard-stop labels (held/user/owned/do-not-merge/do-not-auto-edit absent).
   • Next: inspect pkgs/id/src/web/markdown.rs link rendering, implement allowed-scheme sanitizer with regression tests, open PR.
   • Links: issue id(web): neutralize executable URL schemes in imported Markdown links #5745, task 10643
9. 10 remaining items

   Load more
10. dezren39

    added

    status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

    queue/parkedQueue task is parked (waiting on CI, time, or an event)Queue task is parked (waiting on CI, time, or an event)

    status/parkedDeliberately paused with a recorded resume conditionDeliberately paused with a recorded resume condition

    and removed

    status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

    queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

    on Nov 5, 2026
11. dezren39 commented on Nov 5, 2026

    

    dezren39

    on Nov 5, 2026

    MemberAuthor

    More actions

    🤖 Agent note · parked

    • Agent: queue worker (repo-worker-code), lane code-c
    • Session / ID: task 10643
    • Found via: queue claim
    • Task: Resumed task 10643 for issue id(web): neutralize executable URL schemes in imported Markdown links #5745 and found a live owner session already working it: laptop worktree ~/git/fleet/10643 on branch queue/10643-5745-markdown-link-schemes, PR fix(id/web): neutralize executable URL schemes in Markdown links (#5745) #6339. Their latest test run (/tmp/10643-test3.log on the laptop) passes all 5 test_link_* tests, including the 3 new id(web): neutralize executable URL schemes in imported Markdown links #5745 tests, after fixing the TAB-destination case in test_link_executable_schemes_neutralized (Comrak forms no link for a TAB destination). I did not commit, push, or compete — parked task 10643 for 30 minutes for the owner session to push.
    • Expectation: owner session pushes the test fix to PR fix(id/web): neutralize executable URL schemes in Markdown links (#5745) #6339; a later shift verifies CI (run 42077612952 has been queued since 17:44Z — runner backlog, not a failure) and merges under the standing criteria.
    • Links: PR fix(id/web): neutralize executable URL schemes in Markdown links (#5745) #6339
12. dezren39

    added 2 commits that reference this issue on Nov 5, 2026

    test(id/web): fix tab-obfuscation case in #5745 link-scheme tests

    ...

    402d981

    fix(id/web): neutralize executable URL schemes in Markdown links (#5745…

    ...

    d492d6a
13. developing-today

    added

    status:done

    and removed

    status:in-review

    on Nov 5, 2026
14. developing-today

    closed this as completedon Nov 5, 2026
15. developing-today commented on Nov 5, 2026

    

    developing-todayBot

    on Nov 5, 2026 – with developing.today

    Contributor

    More actions

    agent-note:v1
    state: done (already_done — verified merged/closed)
    queue: repo-health-code-pilot
    task: 10643 (small_fix; worker repo-worker-code; lane code-z)
    by: repo-queue-worker-shift-z
    at: 2026-11-05T19:14Z

    Fresh verification (gh, 2026-11-05T19:13Z): issue #5745 is CLOSED and PR #6339 is MERGED at 2026-11-05T18:44:08Z (merge commit d492d6a). The work this task tracked is landed; the task's awaiting_ci checkpoint is superseded by the merge. Completing task 10643 as already_done with this evidence. The image-src half of the same converter gap is tracked separately as issue #6364 / fix task 10725.
16. dezren39

    removed

    status/parkedDeliberately paused with a recorded resume conditionDeliberately paused with a recorded resume condition

    queue/parkedQueue task is parked (waiting on CI, time, or an event)Queue task is parked (waiting on CI, time, or an event)

    work/assignedQueue worker lifecycle stateQueue worker lifecycle state

    on Nov 5, 2026