[xiphos-source] [crosswire/xiphos] 30b91f: url: restrict clicked-link fallthrough to http/htt...

[Acts1631]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: 30b91fd1885a0cdf7921d152e7dc2e7f551cd222
      https://github.com/crosswire/xiphos/commit/30b91fd1885a0cdf7921d152e7dc2e7f551cd222
  Author: Acts1631 <69813585+acts-1631 at users.noreply.github.com>
  Date:   2026-07-09 (Thu, 09 Jul 2026)

  Changed paths:
    M src/main/url.cc

  Log Message:
  -----------
  url: restrict clicked-link fallthrough to http/https URIs (#1344)

Bible, commentary, and dictionary module content is rendered as HTML
by SWORD's render filters and loaded into the WebKit view essentially
unmodified; there is no sanitization of <a href> values anywhere in
the render/display pipeline.

When a clicked link's URL doesn't match one of Xiphos's internal
schemes (sword://, bible://, passagestudy.jsp, xiphos.url),
main_url_handler() falls through to xiphos_open_default(), which calls
gtk_show_uri_on_window()/ShellExecuteW() on the raw URL with no scheme
check and no user confirmation. A malicious or compromised module
repository could embed a link such as

  <a href="file:///home/user/.ssh/id_rsa">click here</a>

in a commentary or dictionary entry; clicking it opens the local file
with the desktop's default handler for that file, without any
warning.

Restrict this fallthrough to http:// and https:// URIs, which are the
only schemes legitimate module content should need for external links.
Other callers of xiphos_open_default() (About/help/mailing-list/bug-
report menu items) are unaffected.



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications