github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 03:12:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(browser): block non-network navigation schemes

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-21 11:31:13 +01:00
parent c6ee14d60e
commit 220bd95eff
3 changed files with 41 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/browser/navigation-guard.ts
View File

@@ -5,6 +5,7 @@ import {
} from "../infra/net/ssrf.js";
const NETWORK_NAVIGATION_PROTOCOLS = new Set(["http:", "https:"]);
const SAFE_NON_NETWORK_URLS = new Set(["about:blank"]);
export class InvalidBrowserNavigationUrlError extends Error {
constructor(message: string) {
@@ -42,7 +43,12 @@ export async function assertBrowserNavigationAllowed(
}
if (!NETWORK_NAVIGATION_PROTOCOLS.has(parsed.protocol)) {
return;
if (SAFE_NON_NETWORK_URLS.has(parsed.href)) {
return;
}
throw new InvalidBrowserNavigationUrlError(
`Navigation blocked: unsupported protocol "${parsed.protocol}"`,
);
}
await resolvePinnedHostnameWithPolicy(parsed.hostname, {