addons-frontend icon indicating copy to clipboard operation
addons-frontend copied to clipboard

Prevent links from being rendered in user bios

Open diox opened this issue 6 months ago • 1 comments

Fixes mozilla/addons#15641

Context

We have basic URL detection on the server, but this doesn't detect //example.com URLs as it would be a bit too strict - someone could want to use double slashes legitimately... More importantly, this field allows HTML, but the cleaning is handled by addons-frontend through DOMPurify. So, to completely prevent links, we need to adjust the list of allowed tags here.

Testing

Log in, edit your profile, add some HTML in your bio, verify it still works. Then try to add HTML links like <a href="//example.com">link</a> and verify it doesn't get rendered as a link.

diox avatar Jun 23 '25 13:06 diox

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 98.29%. Comparing base (b7a0d15) to head (07f615a). Report is 8 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #13643   +/-   ##
=======================================
  Coverage   98.29%   98.29%           
=======================================
  Files         268      268           
  Lines       10663    10667    +4     
  Branches     3280     3282    +2     
=======================================
+ Hits        10481    10485    +4     
  Misses        169      169           
  Partials       13       13           

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:
  • :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codecov[bot] avatar Jun 23 '25 14:06 codecov[bot]