Incomplete URL scheme check¶

ID: js/incomplete-url-scheme-check
Kind: problem
Security severity: 7.8
Severity: warning
Precision: high
Tags:
   - security
   - correctness
   - external/cwe/cwe-020
   - external/cwe/cwe-184
Query suites:
   - javascript-code-scanning.qls
   - javascript-security-extended.qls
   - javascript-security-and-quality.qls

Click to see the query in the CodeQL repository

URLs starting with javascript: can be used to encode JavaScript code to be executed when the URL is visited. While this is a powerful mechanism for creating feature-rich and responsive web applications, it is also a potential security risk: if the URL comes from an untrusted source, it might contain harmful JavaScript code. For this reason, many frameworks and libraries first check the URL scheme of any untrusted URL, and reject URLs with the javascript: scheme.

However, the data: and vbscript: schemes can be used to represent executable code in a very similar way, so any validation logic that checks against javascript:, but not against data: and vbscript:, is likely to be insufficient.

function sanitizeUrl(url) {
    let u = decodeURI(url).trim().toLowerCase();
    if (u.startsWith("javascript:"))
        return "about:blank";
    return url;
}

function sanitizeUrl(url) {
    let u = decodeURI(url).trim().toLowerCase();
    if (u.startsWith("javascript:") || u.startsWith("data:") || u.startsWith("vbscript:"))
        return "about:blank";
    return url;
}