corner-nav: block javascript:/data: URIs in search preview (URL-scheme allowlist)

67d0b928895454fb23cdab6570487908e9976a19 · 2026-07-29 09:58:10 -0700 · Steve Abrams

Files touched

M public/corner-nav.js

Diff

commit 67d0b928895454fb23cdab6570487908e9976a19
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 29 09:58:10 2026 -0700

    corner-nav: block javascript:/data: URIs in search preview (URL-scheme allowlist)
---
 public/corner-nav.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/public/corner-nav.js b/public/corner-nav.js
index 5f6d493..ca74b20 100644
--- a/public/corner-nav.js
+++ b/public/corner-nav.js
@@ -202,10 +202,17 @@
       return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c];
     });
   }
+  function cnSafeUrl(u) {
+    u = String(u == null ? '' : u).trim();
+    if (!u) return '';
+    var m = u.match(/^([a-z][a-z0-9+.\-]*):/i);
+    if (m && !/^https?$/i.test(m[1])) return '#'; // block javascript:, data:, vbscript:, ...
+    return u;
+  }
   function resHref(p) {
-    return p.product_url || p.url || (p.handle ? '/products/' + p.handle : '#');
+    return cnSafeUrl(p.product_url || p.url || (p.handle ? '/products/' + p.handle : '#'));
   }
-  function resImg(p)   { return p.image_url || p.image || p.featured_image || p.thumbnail || ''; }
+  function resImg(p)   { return cnSafeUrl(p.image_url || p.image || p.featured_image || p.thumbnail || ''); }
   function resTitle(p) { return p.title || p.name || p.sku || 'Untitled'; }
 
   function renderResults(items, q) {

← 8dc74b1 search: /api matcher now covers title+tags+description+type+ · back to 1940swallpaper · search: scroll results into view on mobile (grid was below t c8f5a01 →