[PR] WW-5756 Reject javascript:/vbscript:/data: schemes in href values [struts]

["g0w6y (via GitHub)" <gi...@apache.org>]

g0w6y opened a new pull request, #1986:
URL: https://github.com/apache/struts/pull/1986

   Fixes [WW-5756](https://issues.apache.org/jira/browse/WW-5756)
   
   `<s:a>` built its `href` attribute by neutralizing a literal quote (the `href=` attribute) or blocking a literal `<script` substring (the `value=` attribute, via `DefaultUrlHelper.buildUrl` — a check that appears to date back to S2-002/CVE-2008-6682, WW-2427). Neither stops the value itself from naming an executable scheme: `javascript:alert(1)` needs no quote or `<script` substring to run once the link is activated.
   
   Adds `SafeUriUtil.rejectUnsafeScheme`, an allowlist (`http`, `https`, `mailto`, `tel`) applied before the existing checks, rather than a blocklist of the schemes that happen to be known. The value is normalized the way a browser's own URL parser normalizes it before reading the scheme (strip a leading C0 control/space, remove embedded tab/newline/CR), so a scheme split across those characters is still caught.
   
   Relative, query-only and fragment-only hrefs, and the `http`/`https`/`mailto`/`tel` schemes, are unaffected.
   
   Three regression tests fail without the change: `SafeUriUtilTest`, two new cases in `DefaultUrlHelperTest`, and a new golden-file case in `AnchorTest`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5756 Reject javascript:/vbscript:/data: schemes in href values [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart commented on PR #1986:
URL: https://github.com/apache/struts/pull/1986#issuecomment-5982375763

   Thanks for the PR and the thorough tests.
   
   We're going to close this one. The `href`/`value` of `<s:a>` is chosen by the template author. When a template sends request-derived data into a URL attribute, checking what that data contains is the application's job. The framework doesn't add context-specific encoding or validation on top of what the template asks for (see `THREAT_MODEL.md` §9).
   
   Turning this on by default would also break working pages. The scheme list would quietly rewrite links like our own showcase's `href="javascript:history.back();"` (`apps/showcase/.../actionPrefix/*.ftl`), as well as `ftp:`, `sms:`, custom app schemes and `blob:`/`data:` downloads. They would all become `#` with nothing logged. And because the check sits in `DefaultUrlHelper.buildUrl`, it would also affect `<s:url>`, `<s:form action>` and `URLBean`, not just `<s:a>`.
   
   For applications that render user-supplied links, the recommended approach is to check the value where it comes in: validate it in the action, or allowlist its scheme with a validator. Alternatively, build the link from `action`/`namespace` rather than passing a raw `href`.
   
   Closing as working as intended. Thanks again for the effort.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5756 Reject javascript:/vbscript:/data: schemes in href values [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart closed pull request #1986: WW-5756 Reject javascript:/vbscript:/data: schemes in <s:a> href values
URL: https://github.com/apache/struts/pull/1986


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org