fix(iframe): hand the sinks the validated URL, not the parameter

The scheme and origin checks lived in a boolean guard in another function, so the raw query parameter still reached the iframe src, the history entry and window.open. The validator now returns the normalised href or null, and every sink consumes only that. Which URLs are accepted does not change: openIframe still checks the scheme alone, because the modal opens configured targets that are not among the page's iframe links.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/lint.yml

@@ -51,7 +51,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           cache: npm
           cache-dependency-path: app/package.json
 

.github/workflows/tests.yml

@@ -153,7 +153,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           cache: npm
           cache-dependency-path: app/package.json
 

app/eslint.config.js

@@ -21,6 +21,7 @@ const SHARED = {
   openDynamicPopup: 'readonly',
   closeAllModals: 'readonly',
   isSafeUrl: 'readonly',
+  safeUrl: 'readonly',
   openIframe: 'readonly',
   enterFullscreen: 'readonly',
   exitFullscreen: 'readonly',

app/scripts/copy-vendor.js

@@ -63,6 +63,7 @@ const markedCandidates = [
   path.join(NM, 'marked', 'marked.min.js'),              // v4.x
   path.join(NM, 'marked', 'lib', 'marked.umd.min.js'),   // v5.x
   path.join(NM, 'marked', 'dist', 'marked.min.js'),      // v9+
+  path.join(NM, 'marked', 'lib', 'marked.umd.js'),       // v16+
 ];
 const markedSrc = markedCandidates.find(p => fs.existsSync(p));
 if (!markedSrc) throw new Error('marked: no browser UMD build found in node_modules');

app/static/js/iframe.js

@@ -2,19 +2,20 @@
 let mainElement, originalContent, originalMainStyle, container, customScrollbar, scrollbarContainer;
 let currentIframeUrl = null;
 
-function isAllowedIframeUrl(url) {
+function allowedIframeUrl(url) {
-  if (!isSafeUrl(url)) {
+  const candidate = safeUrl(url);
-    return false;
+  if (candidate === null) {
+    return null;
   }
   const allowedOrigins = new Set([window.location.origin]);
   document.querySelectorAll('a.iframe-link[href]').forEach((link) => allowedOrigins.add(link.origin));
-  return allowedOrigins.has(new URL(url, window.location.href).origin);
+  return allowedOrigins.has(new URL(candidate).origin) ? candidate : null;
 }
 
 // === Auto-open iframe if URL parameter is present ===
 window.addEventListener('DOMContentLoaded', () => {
-  const paramUrl = new URLSearchParams(window.location.search).get('iframe');
+  const paramUrl = allowedIframeUrl(new URLSearchParams(window.location.search).get('iframe'));
-  if (paramUrl && isAllowedIframeUrl(paramUrl)) {
+  if (paramUrl) {
     currentIframeUrl = paramUrl;
     enterFullscreen();
     openIframe(paramUrl);
@@ -43,7 +44,8 @@ function syncIframeHeight() {
 
 // Function to open a URL in an iframe (jQuery version mit 1500 ms Fade)
 function openIframe(url) {
-    if (!isSafeUrl(url)) {
+    const target = safeUrl(url);
+    if (target === null) {
         return;
     }
 
@@ -73,7 +75,7 @@ function openIframe(url) {
 
         // Quelle setzen und mit 1500 ms einblenden
         $iframe
-            .attr('src', url)
+            .attr('src', target)
             .fadeIn(1500, function() {
                 syncIframeHeight();
                 observeIframeNavigation();
@@ -81,8 +83,8 @@ function openIframe(url) {
 
         // URL-State pushen
         var newUrl = new URL(window.location);
-        newUrl.searchParams.set('iframe', url);
+        newUrl.searchParams.set('iframe', target);
-        window.history.pushState({ iframe: url }, '', newUrl);
+        window.history.pushState({ iframe: target }, '', newUrl);
     });
 }
 
@@ -148,8 +150,8 @@ document.addEventListener("DOMContentLoaded", function() {
  */
 function openIframeInNewTab() {
   const params = new URLSearchParams(window.location.search);
-  const iframeUrl = params.get('iframe');
+  const iframeUrl = allowedIframeUrl(params.get('iframe'));
-  if (iframeUrl && isAllowedIframeUrl(iframeUrl)) {
+  if (iframeUrl) {
     window.open(iframeUrl, '_blank');
   } else {
     alert('No iframe is currently open.');

app/static/js/modal.js

@@ -7,15 +7,19 @@ function t(source) {
 
 const SAFE_URL_SCHEMES = ['http:', 'https:', 'mailto:'];
 
-function isSafeUrl(url) {
+function safeUrl(url) {
   try {
     const parsed = new URL(String(url == null ? '' : url), window.location.href);
-    return SAFE_URL_SCHEMES.includes(parsed.protocol);
+    return SAFE_URL_SCHEMES.includes(parsed.protocol) ? parsed.href : null;
   } catch (error) {
-    return false;
+    return null;
   }
 }
 
+function isSafeUrl(url) {
+  return safeUrl(url) !== null;
+}
+
 function iconAndName(item) {
   const nodes = [];
   if (item.icon && item.icon.class) {

tests/integration/test_app_routes.py

@@ -6,6 +6,7 @@ import subprocess
 import sys
 import tempfile
 import unittest
+from html.parser import HTMLParser
 from pathlib import Path
 from unittest.mock import Mock, patch
 
@@ -112,18 +113,29 @@ class TestEscaping(AppRouteMixin, unittest.TestCase):
         self.assertIn("<script>alert('config')", body)
 
 
+class InlineScriptCollector(HTMLParser):
+    def __init__(self):
+        super().__init__()
+        self.inline = []
+
+    def handle_starttag(self, tag, attrs):
+        if tag != "script":
+            return
+        attributes = dict(attrs)
+        if "src" in attributes or attributes.get("type") == "application/json":
+            return
+        self.inline.append(self.get_starttag_text())
+
+
 class TestContentSecurityPolicy(AppRouteMixin, unittest.TestCase):
     def test_page_ships_no_executable_inline_script(self):
         body = self.client.get("/de/").get_data(as_text=True)
 
-        inline = [
+        collector = InlineScriptCollector()
-            tag
+        collector.feed(body)
-            for tag in re.findall(r"<script\b[^>]*>", body)
-            if "src=" not in tag and 'type="application/json"' not in tag
-        ]
 
         self.assertEqual(
-            inline,
+            collector.inline,
             [],
             "a host CSP can only hash an inline script whose content it knows, "
             "and this one changes with every language",

tests/unit/test_i18n.py

@@ -2,8 +2,8 @@ import re
 import shutil
 import tempfile
 import unittest
+import unittest.mock
 from pathlib import Path
-from unittest import mock
 
 import yaml
 
@@ -170,7 +170,7 @@ class TestCatalogMerge(unittest.TestCase):
         )
 
     def test_an_unsupported_code_never_becomes_a_path(self):
-        with mock.patch.object(i18n, "read_catalog") as read:
+        with unittest.mock.patch.object(i18n, "read_catalog") as read:
             self.assertEqual(i18n.catalog("../content/de"), {})
 
         read.assert_not_called()