JS: Fix 2 FPs in TargetBlank.ql

[erik-krogh]

1. mailto: links (found in an anomalous query result)

mailto links are safe, they open in a email-program / webmail (which should be safe).

2. links constructed using template system with safe prefix (reported here: LGTM.com - false positive #4169)

Something like <a href="http://google.com/{{payload}}>safe</a> was already considered safe, but something like <a href="foo.bar#{{payload}}">safe</a> was not.
With this PR we use # and ? as marker chars to determine if the payload is actually part of the query/hash part of the URL.
This does remove some additional FPs in our usual benchmarks.
But it is not perfect, as some template expressions might contain ? or # without those chars ending up as a prefix in the URL.

[esbena]

I have a request for some minor polish. And a discussion:

mailto links are safe, they open in a email-program / webmail (which should be safe).

I am not sure that they are safe. Are we sure that the mailto protocol handlers doesn't preserve the runtime reference to the DOM if the handler implementation somehow knows that the mail client is in another webpage (i.e. webmail)?

I know of security fixes for target=blank links that went to reputable sites such as github.com or google.com, simply because the security model didn't trust external sites, so it doesn't seem like a stretch to distrust arbitrary webmail services.

[esbena]

Let's update getDelimiterMatchingRegexp to have the body:

result = getDelimiterMatchingRegexpWithPrefix(".*")

[erik-krogh]

I am not sure that they are safe. Are we sure that the mailto protocol handlers doesn't preserve the runtime reference to the DOM if the handler implementation somehow knows that the mail client is in another webpage (i.e. webmail)?

If mailto: opens in a webmail client, then window.opener works exactly the same as if it was an ordinary http:// link.
My thinking was that we could trust gmail.com/outlook.com etc..

so it doesn't seem like a stretch to distrust arbitrary webmail services.

Lets do that - I'll revert the mailto: change.

[esbena]

Thanks. Lets add a change-note and merge this.