shadowdao
bf4a9f48eb
M-5: safeUrl() blocked javascript:/vbscript:/data:text/html but allowed data:image/svg+xml, which can execute inline <script>/onload= when loaded as a document/navigation target despite its "image" MIME type (defense in depth -- not currently reachable to execution via this sink, but closing it). Added `data:image/svg+xml` to the existing DANGEROUS_SCHEME_PREFIXES check, so it's caught after the same entity-decode/whitespace-strip/lowercase normalization used for the other blocked schemes (obfuscated variants included). Other data:image/* types (png/jpeg/gif/webp, ...) remain allowed unchanged. M-6: HtmlBlock's purifyHtml() allowed <iframe src> through with no `sandbox` attribute -- a clickjacking/phishing vector even with DOMPurify already stripping script/on*=. Added a DOMPurify afterSanitizeAttributes hook, scoped tightly to each purifyHtml() call (added right before sanitize(), removed in a finally right after) so it can't leak onto other DOMPurify uses or accumulate duplicates across repeated calls, that force-sets a restrictive sandbox (allow-scripts allow-same-origin allow-popups allow-forms -- no allow-top-navigation) and referrerpolicy=no-referrer on every iframe that survives sanitization. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
