fcf433a736a8670c9da0e2af3ac54db24b0aaa3b braney Mon Aug 24 14:47:47 2026 -0700 htmlSanitize: rename the ids that come in with the HTML, refs #38126 The description HTML is printed inside a page of ours, and it is our own JavaScript that looks ids up. A page that carries an id we already use puts two elements of that name in one document, and getElementById returns whichever comes first. Two ids in the public hub pages collide with ours today, one of them "content". An id also becomes a property of that name on window, which reaches the guards we write as "typeof X !== 'undefined' && X". Every id, and every name on an anchor, now gets the prefix descPage- . The hyphen means the window property it makes can never be spelled as a JavaScript name, so it cannot stand in for one of our globals either. A link to a name on the same page, href="#x", is rewritten with the same prefix and keeps working. A link that names another page is left alone: it leaves our page for the hub's own file, where the names are unchanged. Measured over the 5390 description pages of the public hubs: 1643 ids and anchor names renamed, no id left without the prefix, and the number of same page links with nothing to point at is 22 before and 22 after, the same ones. No page loses reader-visible text and the hubCheck warnings are unchanged at 118 pages, since a reader sees nothing of this. diff --git src/lib/tests/expected/htmlSanitizeTest src/lib/tests/expected/htmlSanitizeTest index 6f778d66bfa..9cdddbdf030 100644 --- src/lib/tests/expected/htmlSanitizeTest +++ src/lib/tests/expected/htmlSanitizeTest @@ -1,49 +1,49 @@ in : <html><head><title>T</title><meta charset="utf-8"></head><body class="x"><h2>Head</h2><p>Text</p></body></html> out: <h2>Head</h2><p>Text</p> in : <p>before</p><script>alert(1)</script><style>body{visibility:hidden}</style><p>after</p> out: <p>before</p><p>after</p> (removed the script element and everything inside it) (removed the style element and everything inside it) in : <p>before</p><script>if (a < b) alert(1) out: <p>before</p> (removed the script element and everything inside it) in : <div id="top" class="warn" title="t" onclick="alert(1)">text</div> -out: <div id="top" title="t">text</div> +out: <div id="descPage-top" title="t">text</div> (removed the attribute onclick) in : <a href="javascript:alert(1)">one</a> <a href="java	script:alert(1)">two</a> out: <a>one</a> <a>two</a> (removed a link that used the javascript: scheme) (removed a link that does not read as a plain web address) in : <a href="javascript:alert(1)">three</a> <a href="javascript:alert(1)">four</a> out: <a>three</a> <a>four</a> (removed a link that used the javascript: scheme) in : <a href="jav	ascript:alert(1)">five</a> <a href="java:script:alert(1)">six</a> out: <a>five</a> <a>six</a> (removed a link that does not read as a plain web address) in : <a href="mailto:help@riken.jp?subject=x">write to us</a> out: <a href="mailto:help@riken.jp?subject=x">write to us</a> in : <a href="https://genome.ucsc.edu">u</a> <a href="#anchor" target="_blank">a</a> -out: <a href="https://genome.ucsc.edu">u</a> <a href="#anchor" target="_blank" rel="noopener noreferrer">a</a> +out: <a href="https://genome.ucsc.edu">u</a> <a href="#descPage-anchor" target="_blank" rel="noopener noreferrer">a</a> in : <img src="pic.png" alt="a" onerror="alert(1)" width="20"> out: <img src="pic.png" alt="a" width="20"> (removed the attribute onerror) in : <iframe width="560" src="https://www.youtube.com/embed/abc"></iframe><iframe src="https://example.com/x">fallback</iframe> out: <iframe width="560" src="https://www.youtube.com/embed/abc" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation"></iframe> (removed an iframe, we only allow one that plays a video from a site we know) in : <p style="color:red;behavior:url(#default#VML);text-align:center;position:fixed">p</p> out: <p style="color:red;text-align:center;">p</p> in : <o:p>word</o:p><vertebrates>more</vertebrates> out: wordmore @@ -55,18 +55,21 @@ in : <svg><svg><svg><svg>text out: text (removed the svg element and everything inside it) in : <a href=https://example.com/x\">link text</a> and more text out: <a href="https://example.com/x\"">link text</a> and more text in : <form action="/x"><input name="password"><button>Log in</button></form><p>after</p> out: <p>after</p> (removed the form element and everything inside it) in : <!DOCTYPE html><!-- <p>hidden</p> --><p>shown</p> out: <p>shown</p> +in : <h2 id="methods">M</h2><a name="top">t</a><a href="#methods">same page</a> <a href="other.html#methods">other page</a><a href="#">to the top</a><div id="">no name at all</div> +out: <h2 id="descPage-methods">M</h2><a name="descPage-top">t</a><a href="#descPage-methods">same page</a> <a href="other.html#methods">other page</a><a href="#">to the top</a><div>no name at all</div> + in : <table border="1"><tr><td colspan="2" bgcolor="#eee">cell</td></tr></table> out: <table border="1"><tr><td colspan="2" bgcolor="#eee">cell</td></tr></table>