PolicyEngine / PolicyEngine/policyengine-app-v2
Security: validate footnote inline link href schemes
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 1
- Forks
- 3
- Avg merge
- 1d 50m
- Merged PRs (30d)
- 39
Description
Summary
parseInlineLinks() inserts unvalidated URLs into href, allowing dangerous schemes such as javascript:.
Severity
Medium
Impact
Footnote content can create clickable script URLs even if the markdown pipeline is otherwise hardened.
Affected code
website/src/components/blog/MarkdownFormatter.tsx:846-869,927- mirrored copy in
policyengine-app-v2-blog/app/src/components/blog/MarkdownFormatter.tsx:846-869,986-987
Details
The custom regex parser extracts match[2] and writes it directly into <a href={match[2]}>.
Expected behavior
Only safe URL schemes should be allowed.
Suggested remediation
- Normalize and validate URLs before rendering
- Allow only
http:,https:,mailto:, hash links, and relative URLs as appropriate - Add tests for
javascript:anddata:payloads
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read parseInlineLinks() at the listed ranges in website/src/components/blog/MarkdownFormatter.tsx and the mirrored policyengine-app-v2-blog/app/src/components/blog/MarkdownFormatter.tsx. Trace how match[2] reaches href, then add coverage for javascript: and data: URLs and verify that only the stated safe schemes render as links.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100