Revert "fix(core): block dangerous data: and vbscript: URLs in URL sanitizer"

This reverts commit e96936a.

Author: atscott

packages/core/src/sanitization/html_sanitizer.ts

@@ -195,9 +195,7 @@ class SanitizingHtmlSerializer {
         continue;
       }
       let value = elAttr!.value;
-      // Note: data: URIs with dangerous subtypes (e.g. data:text/html) are now blocked
-      // by _sanitizeUrl, while safe media subtypes (data:image/*, data:video/*, data:audio/*)
-      // are still allowed.
+      // TODO(martinprobst): Special case image URIs for data:image/...
       if (URI_ATTRS[lower]) value = _sanitizeUrl(value);
       this.buf.push(' ', attrName, '="', encodeEntities(value), '"');
     }

packages/core/src/sanitization/url_sanitizer.ts

@@ -15,11 +15,8 @@ import {XSS_SECURITY_URL} from '../error_details_base_url';
  * This regular expression matches a subset of URLs that will not cause script
  * execution if used in URL context within a HTML document. Specifically, this
  * regular expression matches if:
- * (1) Either a protocol that is not javascript: or vbscript:, and that has
- *     valid characters (alphanumeric or [+-.]).
- *     For data: URIs, only safe media subtypes (image/*, video/*, audio/*)
- *     are allowed. Other data: subtypes (e.g. data:text/html) are blocked
- *     as they can lead to script execution in some environments.
+ * (1) Either a protocol that is not javascript:, and that has valid characters
+ *     (alphanumeric or [+-.]).
  * (2) or no protocol.  A protocol must be followed by a colon. The below
  *     allows that by allowing colons only after one of the characters [/?#].
  *     A colon after a hash (#) must be in the fragment.
@@ -36,16 +33,9 @@ import {XSS_SECURITY_URL} from '../error_details_base_url';
  * that. More importantly, it disallows masking of a colon,
  * e.g. "javascript:...".
  *
- * This regular expression was originally taken from the Closure sanitization
- * library and extended to also block vbscript: and dangerous data: subtypes.
- *
- * Note: data:image/svg+xml is allowed because SVG loaded via <img src> is
- * sandboxed by browsers (scripts do not execute). For <a href> contexts,
- * modern browsers (Chrome 60+, Firefox 59+) block top-level navigation to
- * data: URLs entirely, providing an additional layer of defense.
+ * This regular expression was taken from the Closure sanitization library.
  */
-const SAFE_URL_PATTERN =
-  /^(?!javascript:)(?!vbscript:)(?!data:(?!image\/|video\/|audio\/))(?:[a-z0-9+.-]+:|[^&:\/?#]*(?:[\/?#]|$))/i;
+const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:|[^&:\/?#]*(?:[\/?#]|$))/i;
 export function _sanitizeUrl(url: string): string {
   url = String(url);
   if (url.match(SAFE_URL_PATTERN)) return url;

packages/core/test/sanitization/url_sanitizer_spec.ts

@@ -46,8 +46,6 @@ describe('URL sanitizer', () => {
       'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/', // Truncated.
       'data:video/webm;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
       'data:audio/opus;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/',
-      'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==',
-      'data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7',
       'unknown-scheme:abc',
     ];
     for (const url of validUrls) {
@@ -70,31 +68,7 @@ describe('URL sanitizer', () => {
       'jav\u0000ascript:alert();',
     ];
     for (const url of invalidUrls) {
-      it(`invalid ${url}`, () => expect(_sanitizeUrl(url)).toMatch(/^unsafe:/));
-    }
-  });
-
-  describe('vbscript URLs', () => {
-    const vbscriptUrls = ['vbscript:MsgBox("XSS")', 'VBScript:alert()', 'VBSCRIPT:MsgBox("XSS")'];
-    for (const url of vbscriptUrls) {
-      it(`blocks ${url}`, () => expect(_sanitizeUrl(url)).toMatch(/^unsafe:/));
-    }
-  });
-
-  describe('dangerous data: URLs', () => {
-    const dangerousDataUrls = [
-      'data:text/html,<script>alert(1)</script>',
-      'data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==',
-      'data:application/xhtml+xml,<script>alert(1)</script>',
-      'data:text/xml,<script>alert(1)</script>',
-      'DATA:text/html,<script>alert(1)</script>',
-      'data:,<script>alert(1)</script>',
-      'data:application/javascript,alert(1)',
-      'data:text/plain,hello',
-      'data:application/pdf;base64,abc',
-    ];
-    for (const url of dangerousDataUrls) {
-      it(`blocks ${url}`, () => expect(_sanitizeUrl(url)).toMatch(/^unsafe:/));
+      it(`valid ${url}`, () => expect(_sanitizeUrl(url)).toMatch(/^unsafe:/));
     }
   });
 });