tools: reject non-http(s) dashboard URLs in the pool directory

A pool's dashboard URL comes from its self-published status file. Escaping
it for HTML is not enough: a javascript: or data: scheme would still render
as a clickable script-injection on the public directory page. Only emit a
link for http(s) schemes; anything else shows as no link.

1 files changed, 9 insertions, 4 deletions

diff --git a/scripts/build-pool-index.py b/scripts/build-pool-index.py
index 40eb8f4..382b6c3 100644
--- a/scripts/build-pool-index.py
+++ b/scripts/build-pool-index.py
@@ -56,10 +56,15 @@ def render_html(pools, generated_at):
     rows = []
     for p in pools:
         dash = p["dashboardUrl"]
-        dash_html = (
-            '<a href="{0}">dashboard</a>'.format(html.escape(dash, quote=True))
-            if dash else "-"
-        )
+        # Only linkify http(s). The dashboard URL comes from an operator's
+        # self-published status file, so a "javascript:" or "data:" scheme
+        # would become a clickable script-injection on this public page.
+        dash_lower = dash.lower()
+        if dash_lower.startswith("http://") or dash_lower.startswith("https://"):
+            dash_html = '<a href="{0}" rel="noopener noreferrer">dashboard</a>'.format(
+                html.escape(dash, quote=True))
+        else:
+            dash_html = "-"
         rows.append(
             "<tr>"
             "<td>{status}</td>"