Skip to content

links: URL-scheme rules disagree across validate, links.mjs and page-checks #83

Closed

Description

@TMHSDigital

Why it matters
Three modules each decide what counts as an external link. validate.mjs accepts ftp: body links, links.mjs treats only http(s) and mailto: as external, so an ftp:// link validates but then fails the build with the misleading error link target "ftp://…" does not exist. page-checks.mjs whitelists data: hrefs while rule V16 in checks.mjs rejects data: entry URLs, so a build-only run never catches a data: URL. Also, markdown.mjs rejects a line that starts with an autolink <https://…> as raw HTML although renderInline supports autolinks mid-line.

Evidence (reproduced)

  • site/validate.mjs:172 vs site/lib/links.mjs:9 vs site/lib/page-checks.mjs:83 vs site/checks.mjs:605.
  • site/lib/markdown.mjs:339 /^\s*<[A-Za-z!/]/ vs :312.

Suggested approach
One EXTERNAL_SCHEME_RE exported from site/lib/shared.mjs and used by all four places; a dedicated "unsupported scheme" LinkError with the scheme in the message; change the raw-HTML guard to /^\s*<(?!https?:\/\/)[A-Za-z!/]/. Tests for ftp:, data:, javascript: and a line-start autolink.

Done when
The same URL is accepted or rejected identically by validate, build and the page checks, with one message that names the scheme.

Activity

  1. added
    bugSomething isn't working
    hardeningDefensive / robustness improvement, not an exploitable vuln
    on Oct 22, 2026
  2. TMHSDigital commented on Oct 22, 2026

    @TMHSDigital
    OwnerAuthor

    Resolved by #124, merged to main in 1e1cfb8.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghardeningDefensive / robustness improvement, not an exploitable vulnpriority: lowPolish / when convenient

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions