From 78cf0c3cb6752bd36bbc8fe7017d5d60cca13da7 Mon Sep 17 00:00:00 2001 From: Bitflash Date: Fri, 7 Aug 2026 15:07:56 -0300 Subject: tools: reject non-http(s) dashboard URLs in the pool directory A pool's dashboard URL comes from its self-published status file. Escaping it for HTML is not enough: a javascript: or data: scheme would still render as a clickable script-injection on the public directory page. Only emit a link for http(s) schemes; anything else shows as no link. --- scripts/build-pool-index.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/scripts/build-pool-index.py b/scripts/build-pool-index.py index 40eb8f4..382b6c3 100644 --- a/scripts/build-pool-index.py +++ b/scripts/build-pool-index.py @@ -56,10 +56,15 @@ def render_html(pools, generated_at): rows = [] for p in pools: dash = p["dashboardUrl"] - dash_html = ( - 'dashboard'.format(html.escape(dash, quote=True)) - if dash else "-" - ) + # Only linkify http(s). The dashboard URL comes from an operator's + # self-published status file, so a "javascript:" or "data:" scheme + # would become a clickable script-injection on this public page. + dash_lower = dash.lower() + if dash_lower.startswith("http://") or dash_lower.startswith("https://"): + dash_html = 'dashboard'.format( + html.escape(dash, quote=True)) + else: + dash_html = "-" rows.append( "" "{status}" -- cgit v1.2.3