Unify handling of URIs with schemes that are not in the whitelist.

Open gmilde opened this issue 2 months ago • 1 comments

Treat "off-list" schemes as part of a local wiki item name, so that page names like "Parrots: blue or green" are easy to access.

Add check for safe URI scheme to Docbook. Don't drop the link text in HTML. Don't downcase the name in Markdown. Link to local wiki item instead of a silly error in rST.

Fixes #2028.

The following test page shows the rendering of unsafe URIs as well as legitimate page names under various markup formats:

= URI scheme whitelist =

Moin implements a whitelist of approved URI schemes.
If a given URI has an off-list schem, converters (except Mediawiki) 
now treat it as a wiki-local URI reference and link to local item:
 
Moin Wiki: [[javascript:alert%28'hi'%29|click here]],
[[Canada: Nature and Culture]], 
[[Canada: Nature and Culture|Canada]]

[[http:Home]]
 
{{{#!creole
Creole: [[javascript:alert%28'hi'%29|click here]],
[[Canada: Nature and Culture]], 
[[Canada: Nature and Culture|Canada]]

}}}

{{{#!markdown
Markdown: [click here] [id] or [here](javascript:alert%28'hi'%29).
See the page on [Canada](Canada: Nature and Culture).

[id]: javascript:alert('hi')
}}}

{{{#!rst
reStructuredText: `click here <javascript:alert('hi')>`__.
See the pages on `Canada: Nature and Culture`_.
Standalone: <javascript:alert('hi')>, javascript:alert%28'hi'%29.
}}}

{{{#!html
<html>
<p>
HTML: <a href="javascript:alert%28'hi'%29">click here</a>
      <a href="http:Home">Home</a>
      <a href="Canada: Nature and Culture">Canada</a>
</p>
</html>
}}}

{{{#!docbook
<article xmlns='http://docbook.org/ns/docbook' xmlns:xlink='http://www.w3.org/1999/xlink'>
<para>
 DokBook link: <link xlink:href="javascript:alert('hi')">click here</link>,
 <link xlink:href="Canada: Nature and Culture">Canada</link>.
 (Problematic "olinks" are silently ignored: 
 <olink targetdoc="http://example.org/" targetptr="Intro">click here</olink>,
 <olink targetdoc="javascript:alert('hi')">click here</olink>,
 <olink targetdoc="Canada: Nature and Culture">Canada</olink>,
 <olink targetdoc="Canada: Nature and Culture" targetptr="Intro">Canada Intro</olink>.)
</para>
</article>
}}}


{{{#!mediawiki
Mediawiki: uses different syntax for external vs. internal links:
* external links with off-list schemes are not recognized as link syntax  [javascript:alert('hi') click here] vs. [http://example.org/help example link] 
* internal links always get the "wiki.local" pseudo-scheme: [[Canada: Nature and Culture|Canada]], [[http://jedmodes.sf.net Jedmodes]]
}}}

Dec 09 '25 10:12 gmilde

TODO: Currently, there are only pytest test cases for rST. Once the desired handling is agreed, add test cases for the other converters.

Dec 09 '25 10:12 gmilde