[0.10] Ban javascript URLs in @lexical/link (#4342)

packages/lexical-link/src/__tests__/unit/LexicalLinkNode.test.ts

@@ -205,6 +205,18 @@ describe('LexicalLinkNode tests', () => {
       });
     });
 
+    test('LinkNode.createDOM() sanitizes javascript: URLs', async () => {
+      const {editor} = testEnv;
+
+      await editor.update(() => {
+        // eslint-disable-next-line no-script-url
+        const linkNode = new LinkNode('javascript:alert(0)');
+        expect(linkNode.createDOM(editorConfig).outerHTML).toBe(
+          '<a href="about:blank" class="my-link-class"></a>',
+        );
+      });
+    });
+
     test('LinkNode.updateDOM()', async () => {
       const {editor} = testEnv;
 

packages/lexical-link/src/index.ts

@@ -44,6 +44,14 @@ export type SerializedLinkNode = Spread<
   Spread<LinkAttributes, SerializedElementNode>
 >;
 
+const SUPPORTED_URL_PROTOCOLS = new Set([
+  'http:',
+  'https:',
+  'mailto:',
+  'sms:',
+  'tel:',
+]);
+
 /** @noInheritDoc */
 export class LinkNode extends ElementNode {
   /** @internal */
@@ -78,7 +86,7 @@ export class LinkNode extends ElementNode {
 
   createDOM(config: EditorConfig): HTMLAnchorElement {
     const element = document.createElement('a');
-    element.href = this.__url;
+    element.href = this.sanitizeUrl(this.__url);
     if (this.__target !== null) {
       element.target = this.__target;
     }
@@ -154,6 +162,19 @@ export class LinkNode extends ElementNode {
     return node;
   }
 
+  sanitizeUrl(url: string): string {
+    try {
+      const parsedUrl = new URL(url);
+      // eslint-disable-next-line no-script-url
+      if (!SUPPORTED_URL_PROTOCOLS.has(parsedUrl.protocol)) {
+        return 'about:blank';
+      }
+    } catch (e) {
+      return 'https://';
+    }
+    return url;
+  }
+
   exportJSON(): SerializedLinkNode | SerializedAutoLinkNode {
     return {
       ...super.exportJSON(),