base.js: unused lt.markdown module has no URL-protocol allowlist on links — latent stored-XSS trap #43

New Issue

2026-08-31T21:29:47-04:00

jared commented

2026-08-31 21:29:47 -04:00

Severity: Low (currently dead code, but a landmine)

assets/js/base.js (~lines 2826-2884) defines an lt.markdown module that is confirmed dead code today (markdown.js's parseMarkdown() is what's actually wired up everywhere in the app; grep for lt.markdown. outside base.js itself returns zero hits).

However, its link handler (\[text\](url) → href="url") has no protocol allowlist, unlike markdown.js's equivalent, which explicitly restricts to http:/https:/mailto:. The module's own doc comment invites future misuse: "For full GFM, swap in marked.js: window.marked && marked.parse()" and it's presented as the generic web_template shared utility.

Impact: If any future template switches to lt.markdown.init(...) instead of the app's own parseMarkdown(), a comment/field containing [click me](javascript:alert(document.cookie)) would render as a live, clickable stored-XSS link.

Fix: Either delete the unused lt.markdown module from this app's copy of base.js, or add the same protocol allowlist markdown.js uses, so it can't become a trap for a future edit.

**Severity:** Low (currently dead code, but a landmine) `assets/js/base.js` (~lines 2826-2884) defines an `lt.markdown` module that is confirmed dead code today (`markdown.js`'s `parseMarkdown()` is what's actually wired up everywhere in the app; grep for `lt.markdown.` outside `base.js` itself returns zero hits). However, its link handler (`\[text\](url)` → `href="url"`) has **no protocol allowlist**, unlike `markdown.js`'s equivalent, which explicitly restricts to `http:`/`https:`/`mailto:`. The module's own doc comment invites future misuse: "For full GFM, swap in marked.js: `window.marked && marked.parse()`" and it's presented as the generic web_template shared utility. **Impact:** If any future template switches to `lt.markdown.init(...)` instead of the app's own `parseMarkdown()`, a comment/field containing `[click me](javascript:alert(document.cookie))` would render as a live, clickable stored-XSS link. **Fix:** Either delete the unused `lt.markdown` module from this app's copy of `base.js`, or add the same protocol allowlist `markdown.js` uses, so it can't become a trap for a future edit.

jared added the dead-code priority/low security labels 2026-09-08 10:15:44 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#43