cannot add JavaScript-Shortcuts

[auitz]

Describe the bug
It is not possible to add JavaScript shortcuts / bookmarks - neither via floccus (sync client) nor via the WebUI.

To Reproduce
Steps to reproduce the behavior:
WebUI: insert a JavaScript shortcut and try to save it -> is not possible
floccus: create a bookmark entry, start the synchronization -> this bookmark is not displayed in the WebUI and after a new synchronization it is also deleted in the browser bookmarks

Expected behavior
The bookmarks are created and also synchronized.

Desktop:

• OS (Browser 2, 3): Windows 10, 1903
• OS (Browser 1): Windows 7
• Browser 1: Firefox 69.0.1 with floccus
• Browser 2: Firefox 69.0.1 with floccus
• Browser 3: Chrome 77.0.3865.90 with floccus

Server:

• OS: Docker image nextcloud-fpm
• HTTP server: Docker image nginx
• Database: Docker image MariaDB
• Nextcloud version: 17.0.0
• Bookmarks app version: 2.2.0

Example:
javascript: (function () {localStorage.clear(); sessionStorage.clear(); alert("Storage cleared."); })();

[marcelklehr]

This was a conscious choice to avoid XSS attacks on your nextcloud. It might be worth revisiting, however.

[auitz]

It would be great if this could be revised. If necessary, the WebUI can also display it in such a way that the JavaScript shortcuts cannot be executed via WebUI, as this will not be necessary in it.

Should I create a feature request for this or can this also be done via this ticket?

[marcelklehr]

That's fine with this ticket.

[joshcsullivan]

+1 for the ability to sync JavaScript bookmarklets.

I have a couple folders of different javascript bookmarklets, and currently have to export and move them over to the other machines when I update them.

[marcelklehr]

@SuperSandro2000 I think this would be a good fit for a first contribution, if you're up for that. This would entail

1. Extending the validation/normalization to support javascript: links (here)
2. Preventing XSS attacks by disabling the link in the UI (here)
3. Optionally: Adding some special favicon and handling of preview images for javascript: links (here and here)

Once that is done, I'll have a look at how to conditionally add support in floccus.

[SuperSandro2000]

Anyone is free to solve this. I probably won't find the time and motivation for it in the next months.

[1RandomDev]

Any updates on this? Maybe the XSS issue could be resolved by just not making the links clickable in the Nextcloud webinterface or maybe an option in the admin interface to add "trusted" users that can bypass this restriction. I personally only sync my own javascript bookmarks via floccus and open them directly in the browser.

[godfuture]

I have raised the same issue in Floccus addon:
floccusaddon/floccus#1371

So adding another thought into the discussion...
Firefox Sync is not preventing these bookmarks to be synced. Why should Nextcloud prevent it? Is the attack vector in executing malicious Javascript bookmarks in Nextcloud bookmark app bigger than opening them in the client browser?

If yes, one step forward would be to add those bookmarks to Nextcloud, but not allow execution from bookmark app. Then client browsers would still sync them.