rusackas opened a new pull request, #40622:
URL: https://github.com/apache/superset/pull/40622
### SUMMARY
`SafeMarkdown` passed `transformLinkUri={null}` to react-markdown (v8). That
`null` explicitly **disables** react-markdown's built-in link-protocol
filtering (its default `uriTransformer`). It was set intentionally in #26211 to
support custom link schemes in markdown — but as a side effect it also lets
`javascript:`, `vbscript:` and `data:` links render.
This is most impactful when the `EscapeMarkdownHtml` feature flag is
enabled: in that branch `rehypePlugins` is empty (no `rehype-sanitize`), so
**nothing** filtered link `href`s — even though the flag's name implies
stronger sanitization. (When the flag is off, `rehype-sanitize`'s
`defaultSchema` happened to filter href protocols, masking the gap.)
Rather than restoring react-markdown's allowlist (which would re-break the
custom schemes from #26211), this adds a **blocklist** transformer:
- Blocks the protocols that can execute script (`javascript`, `vbscript`,
`data`), including case- and whitespace-obfuscated variants (e.g.
`java\tscript:`).
- Leaves everything else untouched: `http(s)`, `mailto`, relative URLs,
anchors, and arbitrary custom schemes (preserving #26211).
- Applied **unconditionally**, independent of the `EscapeMarkdownHtml` flag.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — link filtering; legitimate links are unaffected.
### TESTING INSTRUCTIONS
```
cd superset-frontend
npm run test --
packages/superset-ui-core/test/components/SafeMarkdown.test.tsx
```
Added a `transformLinkUri` unit-test suite: blocks dangerous protocols (with
case/whitespace obfuscation), keeps safe URLs (`https`, `mailto`, relative,
anchors), and preserves custom schemes. (react-markdown is globally mocked in
the jest shim, so link handling is unit-tested on the exported transformer
directly; the transformer is wired unconditionally so it applies in both
feature-flag states.)
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
