corner-nav: block javascript:/data: URIs in search preview (URL-scheme allowlist)

3ace871ecb6efbdd9bc45c5bdef31b7f7b28cf5d · 2026-07-29 09:58:11 -0700 · Steve Abrams

Files touched

M corner-nav.js

Diff

commit 3ace871ecb6efbdd9bc45c5bdef31b7f7b28cf5d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 29 09:58:11 2026 -0700

    corner-nav: block javascript:/data: URIs in search preview (URL-scheme allowlist)
---
 corner-nav.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/corner-nav.js b/corner-nav.js
index 5f6d493..ca74b20 100644
--- a/corner-nav.js
+++ b/corner-nav.js
@@ -202,10 +202,17 @@
       return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c];
     });
   }
+  function cnSafeUrl(u) {
+    u = String(u == null ? '' : u).trim();
+    if (!u) return '';
+    var m = u.match(/^([a-z][a-z0-9+.\-]*):/i);
+    if (m && !/^https?$/i.test(m[1])) return '#'; // block javascript:, data:, vbscript:, ...
+    return u;
+  }
   function resHref(p) {
-    return p.product_url || p.url || (p.handle ? '/products/' + p.handle : '#');
+    return cnSafeUrl(p.product_url || p.url || (p.handle ? '/products/' + p.handle : '#'));
   }
-  function resImg(p)   { return p.image_url || p.image || p.featured_image || p.thumbnail || ''; }
+  function resImg(p)   { return cnSafeUrl(p.image_url || p.image || p.featured_image || p.thumbnail || ''); }
   function resTitle(p) { return p.title || p.name || p.sku || 'Untitled'; }
 
   function renderResults(items, q) {

← 27b1c65 corner-nav: live as-you-type search with thumbnail previews · back to Goldleafwallpaper · Fix metalleaf-rml-refresh: restore Homebrew PATH so launchd 8d1f941 →