Headline
CVE-2023-34245: Apply isUrl option to pasted links #2239 (#2240) · udecode/plate@93dd571
@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. @udecode/plate-link 20.0.0 resolves this issue by introducing an allowedSchemes option to the link plugin, defaulting to ['http', 'https', 'mailto', 'tel']. URLs using a scheme that isn’t in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the LinkElement and PlateFloatingLink components with implementations that explicitly check the URL scheme before rendering any anchor elements.
@@ -1,8 +1,10 @@
import {
createPluginFactory,
isUrl as isUrlProtocol,
isUrl,
RangeBeforeOptions,
} from '@udecode/plate-core’;
import { getLinkAttributes, validateUrl } from './utils/index’;
import { TLinkElement } from './types’;
import { withLink } from './withLink’;
export const ELEMENT_LINK = 'a’;
Expand All
@@ -27,6 +29,12 @@ export interface LinkPlugin {
*/
triggerFloatingLinkHotkeys?: string | string[];
/**
* List of allowed URL schemes.
* @default ['http’, 'https’, 'mailto’, ‘tel’]
*/
allowedSchemes?: string[];
/**
* Callback to validate an url.
* @default isUrl
Expand All
@@ -53,12 +61,10 @@ export const createLinkPlugin = createPluginFactory<LinkPlugin>({
key: ELEMENT_LINK,
isElement: true,
isInline: true,
props: ({ element }) => ({
nodeProps: { href: element?.url, target: element?.target },
}),
withOverrides: withLink,
options: {
isUrl: isUrlProtocol,
allowedSchemes: ['http’, 'https’, 'mailto’, ‘tel’],
isUrl,
rangeBeforeOptions: {
matchString: ' ',
skipInvalid: true,
Expand All
@@ -67,17 +73,28 @@ export const createLinkPlugin = createPluginFactory<LinkPlugin>({
triggerFloatingLinkHotkeys: 'meta+k, ctrl+k’,
},
then: (editor, { type }) => ({
props: ({ element }) => ({
nodeProps: getLinkAttributes(editor, element as TLinkElement),
}),
deserializeHtml: {
rules: [
{
validNodeName: 'A’,
},
],
getNode: (el) => ({
type,
url: el.getAttribute(‘href’),
target: el.getAttribute(‘target’) || '_blank’,
}),
getNode: (el) => {
const url = el.getAttribute(‘href’);
if (url && validateUrl(editor, url)) {
return {
type,
url,
target: el.getAttribute(‘target’) || '_blank’,
};
}
return undefined;
},
},
}),
});
Related news
### Impact Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. ### Patches `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM. ### Workarounds If you are unable to update `@udecode/plate-link` to version 20.0.0, we recommend overriding the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.