paulandClaude Opus 4.8 b97c82d92e fix(security): validate MB url-rel links by scheme + host, not substring (task/harden-resolver-link-validation) ...

relUrls() picked MusicBrainz link relations by substring (u.includes("bandcamp.com")) with
no scheme check, so a non-http(s) resource or a look-alike host (https://evilbandcamp.com,
javascript:...bandcamp.com...) could be returned and become an injected link's href. Now:
isHttpUrl() accepts http/https only, and matching is by PARSED hostname (=== host ||
endsWith "."+host). Resolver-only; extension unaffected; pure + unit-tested (18 total green).

Source: plan/steward-linker-security SCOUT 2026-06-17.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-17 18:33:59 +00:00

..

.env.example

feat: reddit -> spotify/bandcamp artist linker MVP (extension + resolver service)

2026-06-14 21:33:33 +00:00

lib.js

fix(security): validate MB url-rel links by scheme + host, not substring (task/harden-resolver-link-validation)

2026-06-17 18:33:59 +00:00

lib.test.js

fix(security): validate MB url-rel links by scheme + host, not substring (task/harden-resolver-link-validation)

2026-06-17 18:33:59 +00:00

package.json

feat: stewardship doctrine + zero-dep test infra (closes issue/linker-code-stewards-and-test-infra)

2026-06-16 06:36:41 +00:00

resolver.js

feat: direct Spotify/Bandcamp links via MusicBrainz url-relations (task/odesli-direct-links)

2026-06-16 12:35:33 +00:00