Check image URL schemes in safe mode

CHANGES.md

@@ -27,6 +27,7 @@
 - [pull #743] Add a `strip-syntax` option to the `header-ids` extra that leaves link URLs, image paths, inline HTML tags and emphasis markers out of header ids (#192)
 - [pull #747] Fix `link-patterns` extra linking text inside Markdown links and images whose label wraps onto another line
 - [pull #759] Fix `fenced-code-blocks` extra not recognizing code blocks whose language name contains `#` or `.`, such as `c#`, `f#` and `vb.net`
+- [pull #766] Fix `safe_mode` allowing `javascript:` and other unsafe URLs in image sources (#764)
 
 
 ## python-markdown2 2.5.5

lib/markdown2.py

@@ -3248,6 +3248,17 @@ def process_image(self, url: str, title_attr: str, link_text: str) -> Tuple[str,
             2. The length of the opening HTML tag in the string. For `<img>` it's the whole string.
                This section will be skipped by the link processor
         '''
+        if self.md.safe_mode and not self.md._safe_href.match(url):
+            # same check as links, but keep allowing base64 image data URLs
+            data_url = self.md._data_url_re.match(url)
+            if not (
+                data_url
+                and (data_url.group('mime') or '').startswith('image/')
+                and data_url.group('token') == ';base64'
+                and re.fullmatch(r'[A-Za-z0-9+/=]*', data_url.group('data'))
+            ):
+                url = '#'
+
         img_class_str = self.md._html_class_str_from_tag("img")
         result = (
             f'<img src="{self.md._protect_url(url)}"'

test/tm-cases/basic_safe_mode.html

@@ -22,11 +22,11 @@
 
 <p><img src="http://example.com/image.gif?h=200&amp;w=500" alt="ok img" /></p>
 
-<p><img src="http://example.com&quot;onclick=&quot;alert(1)" alt="img" /></p>
+<p><img src="#" alt="img" /></p>
 
 <p><img src="http://example.com" alt="img2" title="text&quot;onclick=&quot;alert(1)" /></p>
 
-<p><img src="http://example.com&gt;[HTML_REMOVED]alert(1)[HTML_REMOVED]" alt="img3" /></p>
+<p><img src="#" alt="img3" /></p>
 
 <p>&lt;img src="javascript:alert(1)"</p>
 

test/tm-cases/image_safe_urls.html

@@ -0,0 +1,25 @@
+<h1>Safe images</h1>
+
+<p><img src="https://www.example.com/a.png" alt="Safe image 1" /></p>
+
+<p><img src="/a.png" alt="Safe image 2" /></p>
+
+<p><img src="data:image/png;base64,iVBORw0KGgo=" alt="Safe image 3" /></p>
+
+<h1>Bad protocols</h1>
+
+<p><img src="#" alt="Unsafe image 1" /></p>
+
+<p><img src="#" alt="Unsafe image 2" /></p>
+
+<p><img src="#" alt="Unsafe image 3" /></p>
+
+<p><img src="#" alt="Unsafe image 4" /></p>
+
+<h1>Reference images</h1>
+
+<p><img src="https://www.example.com/a.png" alt="Safe ref" /></p>
+
+<p><img src="#" alt="Unsafe ref" /></p>
+
+<p><img src="#" alt="Unsafe image 5" /></p>

test/tm-cases/image_safe_urls.opts

@@ -0,0 +1 @@
+{"safe_mode": "escape"}

test/tm-cases/image_safe_urls.tags

@@ -0,0 +1 @@
+safe_mode

test/tm-cases/image_safe_urls.text

@@ -0,0 +1,28 @@
+# Safe images
+
+![Safe image 1](https://www.example.com/a.png)
+
+![Safe image 2](/a.png)
+
+![Safe image 3](data:image/png;base64,iVBORw0KGgo=)
+
+# Bad protocols
+
+![Unsafe image 1](javascript:alert(1))
+
+![Unsafe image 2](JaVaScRiPt:alert(1))
+
+![Unsafe image 3](vbscript:msgbox(1))
+
+![Unsafe image 4](data:text/html,hello)
+
+# Reference images
+
+![Safe ref][safe]
+
+![Unsafe ref][unsafe]
+
+[safe]: https://www.example.com/a.png
+[unsafe]: javascript:alert(1)
+
+![Unsafe image 5](data:image/png;base64,`x" onerror="alert(1)//`)

test/tm-cases/issue603_xss.html

@@ -1,6 +1,6 @@
-<p><img src="code&gt;&quot; onerror=alert()//&lt;/code" alt="" /></p>
+<p><img src="#" alt="" /></p>
 
-<p><img src="&quot; onerror=alert()//" alt="" />
+<p><img src="#" alt="" />
 <a href="#"></a>
-<img src="`&quot; onerror=alert()//`" alt="" />
-<img src="&lt;code&gt;&quot; onerror=alert()//&lt;code&gt;" alt="" /></p>
+<img src="#" alt="" />
+<img src="#" alt="" /></p>

test/tm-cases/xss_code_spans_issue726.html

@@ -1,6 +1,4 @@
-<p>&lt;x<img src="code&gt;&lt;a
-&gt;&lt;/code" alt="" />&gt;&lt;svg onload=alert(origin)<img src="code&gt;&lt;a
-&gt;&lt;/code" alt="" /></p>
+<p>&lt;x<img src="#" alt="" />&gt;&lt;svg onload=alert(origin)<img src="#" alt="" /></p>
 
 <p>Code spans still come out escaped once: <code>a&lt;b</code>, <code>&lt;b&gt;</code> and <code>C:\&lt;folder&gt;</code></p>
 

test/tm-cases/xss_smuggling_spans_in_image_attrs.html

@@ -1,6 +1,6 @@
 <p><img src="x" alt="" title="&lt;code&gt;&quot; onerror=alert(1)//&lt;/code&gt;&quot;" /></p>
 
-<p><img src="" alt="&lt;code&gt;&quot; onerror=&quot;alert(1)//&lt;/code&gt;" /></p>
+<p><img src="#" alt="&lt;code&gt;&quot; onerror=&quot;alert(1)//&lt;/code&gt;" /></p>
 
 <p><img src="B" alt="A" title="&lt;C D=&quot;E&quot; onerror=alert(origin) &gt;" /></p>
 
@@ -13,11 +13,10 @@
 <li><img src="x" alt="" title="&lt;code&gt;![](&lt;/code&gt;" /> onerror=alert(origin) )</li>
 </ul>
 
-<p><img src="code&gt;&lt;A B=&quot;
-&quot; onerror=&quot;alert(origin)&quot;&gt;&lt;/code" alt="" /></p>
+<p><img src="#" alt="" /></p>
 
 <p><a href="http://onclick=alert(origin)//![](x)">http://onclick=alert(origin)//![](x)</a></p>
 
 <p><a href="http://onclick=alert(origin)//[&lt;code">http://onclick=alert(origin)//[&lt;code</a>Click me</code>]()&gt;</p>
 
-<p>![x](&lt;"`"<img src="x &quot;&lt;A B=&quot;&quot; onerror=&quot;alert(origin)&quot;&gt;`" alt="x" /></p>
+<p>![x](&lt;"`"<img src="#" alt="x" /></p>