Harden Markdown sanitization and image policy

Author: stefan-ernst

frontend/src/lib/components/Toggle.svelte

@@ -5,6 +5,7 @@
     size = 'medium',           // 'small' | 'medium' | 'large'
     label = null,
     labelPosition = 'right',   // 'left' | 'right'
+    ariaLabel = null,
     onchange = null,
     id = undefined,
     dataTestid = undefined,
@@ -57,7 +58,7 @@
     data-testid={dataTestid}
     role="switch"
     aria-checked={checked}
-    aria-label="Toggle"
+    aria-label={ariaLabel || 'Toggle'}
     {disabled}
     class="relative inline-flex items-center shrink-0 rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-[var(--ds-border-focused)]
            disabled:opacity-50 disabled:cursor-not-allowed {currentSize.button} {className}"

frontend/src/lib/editors/milkdown-link-sanitizer.js

@@ -3,35 +3,21 @@
 
 import { Plugin, PluginKey } from '@milkdown/kit/prose/state';
 import { $prose } from '@milkdown/kit/utils';
+import { isSafeMarkdownURL } from '../utils/markdown-url-policy.ts';
 
-const SAFE_URL_SCHEMES = /^(https?:|mailto:|tel:|page:|#|\/)/i;
-const SAFE_IMAGE_URL_SCHEMES = /^(https?:|blob:|#|\/)/i;
-
-/**
- * Check whether a URL is safe to navigate to.
- * Allows http(s), mailto, tel, fragment (#), and relative URLs.
- * Blocks javascript:, vbscript:, data:, and any other dangerous scheme.
- * @param {string} url
- * @returns {boolean}
- */
-function isSafeUrlWithSchemes(url, safeSchemes) {
+function isEmptyUrl(url) {
   if (!url) return true;
-  const trimmed = url.trim();
-  if (trimmed === '') return true;
-  // Reject protocol-relative URLs (`//evil.com`) — browsers resolve these against the
-  // current page's scheme, so they're effectively external navigation without a scheme.
-  if (trimmed.startsWith('//')) return false;
-  // Relative URLs (no scheme) are safe
-  if (!trimmed.includes(':')) return true;
-  return safeSchemes.test(trimmed);
+  return url.trim() === '';
 }
 
+/** @param {string} url */
 export function isSafeUrl(url) {
-  return isSafeUrlWithSchemes(url, SAFE_URL_SCHEMES);
+  return isEmptyUrl(url) || isSafeMarkdownURL(url);
 }
 
+/** @param {string} url */
 export function isSafeImageUrl(url) {
-  return isSafeUrlWithSchemes(url, SAFE_IMAGE_URL_SCHEMES);
+  return isEmptyUrl(url) || isSafeMarkdownURL(url, { image: true, allowBlobImage: true });
 }
 
 const linkSanitizerPluginKey = new PluginKey('link-sanitizer');

frontend/src/lib/locales/ar/admin.js

@@ -464,6 +464,10 @@ export default {
       pluginExecution: 'تنفيذ أوامر واجهة سطر أوامر الإضافات',
       pluginExecutionDesc: 'السماح للإضافات بتنفيذ أوامر shell على الخادم',
       pluginExecutionWarning: 'تحذير: تفعيل هذا الإعداد يسمح للإضافات بتنفيذ أوامر shell. تقتصر الأوامر على مجلد كل إضافة لأسباب أمنية. فعّل فقط إذا كنت تثق بجميع الإضافات المثبتة.',
+      externalImages: 'صور Markdown الخارجية',
+      externalImagesDesc: 'السماح لمحتوى Markdown بتحميل الصور من أي مضيف HTTP أو HTTPS',
+      externalImagesRefresh: 'تُطبّق التغييرات عند تحميل المستخدمين للصفحة أو تحديثها. تظل صور Unsplash وAtlassian ومضيفات Jira المُعدّة والمرفقات والصور المضمّنة متاحة عند التعطيل.',
+      externalImagesWarning: 'قد تكشف الصور الخارجية عناوين IP وتفاصيل المتصفح للمشاهدين، وقد ترسل طلبات إلى خدمات يمكن الوصول إليها من شبكاتهم. فعّل هذا الخيار فقط إذا كنت تثق بمؤلفي المحتوى.',
       failedToLoad: 'فشل في تحميل إعدادات الأمان',
       failedToSave: 'فشل في حفظ الإعدادات',
     },

frontend/src/lib/locales/de/admin.js

@@ -468,6 +468,10 @@ export default {
       pluginExecution: 'Plugin-CLI-Befehlsausführung',
       pluginExecutionDesc: 'Plugins erlauben, Shell-Befehle auf dem Server auszuführen',
       pluginExecutionWarning: 'Warnung: Das Aktivieren dieser Einstellung erlaubt Plugins, Shell-Befehle auszuführen.',
+      externalImages: 'Externe Markdown-Bilder',
+      externalImagesDesc: 'Markdown-Inhalten erlauben, Bilder von beliebigen HTTP- oder HTTPS-Hosts zu laden',
+      externalImagesRefresh: 'Änderungen gelten, sobald Benutzer eine Seite neu laden. Unsplash, Atlassian, konfigurierte Jira-Hosts, Anhänge und eingebettete Bilder bleiben bei deaktivierter Einstellung verfügbar.',
+      externalImagesWarning: 'Externe Bilder können IP-Adressen und Browserdetails von Betrachtern offenlegen und Anfragen an Dienste senden, die aus deren Netzwerk erreichbar sind. Nur aktivieren, wenn Sie den Autoren der Inhalte vertrauen.',
       failedToLoad: 'Sicherheitseinstellungen konnten nicht geladen werden',
       failedToSave: 'Einstellungen konnten nicht gespeichert werden',
     },

frontend/src/lib/locales/en/admin.js

@@ -459,6 +459,12 @@ export default {
       pluginExecutionDesc: 'Allow plugins to execute shell commands on the server',
       pluginExecutionWarning:
         "Warning: Enabling this setting allows plugins to execute shell commands. Commands are restricted to each plugin's own directory for security. Only enable if you trust all installed plugins.",
+      externalImages: 'External Markdown Images',
+      externalImagesDesc: 'Allow Markdown content to load images from any HTTP or HTTPS host',
+      externalImagesRefresh:
+        'Changes apply when users next load or refresh a page. Unsplash, Atlassian, configured Jira hosts, attachments, and embedded images remain available when disabled.',
+      externalImagesWarning:
+        "External images can reveal viewer IP addresses and browser details, and can send requests to services reachable from a viewer's network. Enable only if you trust content authors.",
       failedToLoad: 'Failed to load security settings',
       failedToSave: 'Failed to save settings',
     },

frontend/src/lib/locales/es/admin.js

@@ -463,6 +463,10 @@ export default {
       pluginExecution: 'Ejecución de comandos CLI de plugins',
       pluginExecutionDesc: 'Permitir a los plugins ejecutar comandos shell en el servidor',
       pluginExecutionWarning: 'Advertencia: Habilitar esta configuración permite a los plugins ejecutar comandos shell. Los comandos están restringidos al directorio de cada plugin por seguridad. Solo habilite si confía en todos los plugins instalados.',
+      externalImages: 'Imágenes externas en Markdown',
+      externalImagesDesc: 'Permitir que el contenido Markdown cargue imágenes desde cualquier host HTTP o HTTPS',
+      externalImagesRefresh: 'Los cambios se aplican cuando los usuarios vuelven a cargar o actualizan una página. Unsplash, Atlassian, los hosts de Jira configurados, los adjuntos y las imágenes incrustadas siguen disponibles cuando está desactivado.',
+      externalImagesWarning: 'Las imágenes externas pueden revelar las direcciones IP y los detalles del navegador de los visitantes, y enviar solicitudes a servicios accesibles desde su red. Actívelo solo si confía en los autores del contenido.',
       failedToLoad: 'Error al cargar la configuración de seguridad',
       failedToSave: 'Error al guardar la configuración',
     },

frontend/src/lib/locales/pt-BR/admin.js

@@ -463,6 +463,10 @@ export default {
       pluginExecution: 'Execução de Comandos CLI de Plugins',
       pluginExecutionDesc: 'Permitir que plugins executem comandos shell no servidor',
       pluginExecutionWarning: 'Aviso: Ativar esta configuração permite que plugins executem comandos shell. Os comandos são restritos ao diretório de cada plugin por segurança. Ative apenas se confiar em todos os plugins instalados.',
+      externalImages: 'Imagens externas em Markdown',
+      externalImagesDesc: 'Permitir que conteúdo Markdown carregue imagens de qualquer host HTTP ou HTTPS',
+      externalImagesRefresh: 'As alterações entram em vigor quando os usuários carregam ou atualizam uma página. Unsplash, Atlassian, hosts do Jira configurados, anexos e imagens incorporadas continuam disponíveis quando desativado.',
+      externalImagesWarning: 'Imagens externas podem revelar endereços IP e detalhes do navegador dos visitantes e enviar solicitações a serviços acessíveis pela rede deles. Ative somente se confiar nos autores do conteúdo.',
       failedToLoad: 'Falha ao carregar configurações de segurança',
       failedToSave: 'Falha ao salvar configurações',
     },

frontend/src/lib/locales/zh-CN/admin.js

@@ -364,6 +364,10 @@ export default {
       pluginExecution: '插件 CLI 命令执行',
       pluginExecutionDesc: '允许插件在服务器上执行 Shell 命令',
       pluginExecutionWarning: '警告：启用此设置允许插件执行 Shell 命令。出于安全考虑，命令限制在每个插件自己的目录中。仅在信任所有已安装插件时启用。',
+      externalImages: '外部 Markdown 图片',
+      externalImagesDesc: '允许 Markdown 内容从任意 HTTP 或 HTTPS 主机加载图片',
+      externalImagesRefresh: '更改会在用户下次加载或刷新页面时生效。禁用时，Unsplash、Atlassian、已配置的 Jira 主机、附件和嵌入图片仍可使用。',
+      externalImagesWarning: '外部图片可能泄露查看者的 IP 地址和浏览器信息，并向其网络可访问的服务发送请求。仅在信任内容作者时启用。',
       failedToLoad: '加载安全设置失败',
       failedToSave: '保存设置失败',
     },

frontend/src/lib/settings/SecuritySettings.svelte

@@ -1,6 +1,6 @@
 <script>
   import { onMount } from 'svelte';
-  import { Shield, Calendar, Loader2, Terminal, Key, Users, UserCog, AlertTriangle, ChevronDown, ChevronUp } from '@lucide/svelte';
+  import { Shield, Calendar, Image as ImageIcon, Loader2, Terminal, Key, Users, UserCog, AlertTriangle, ChevronDown, ChevronUp } from '@lucide/svelte';
   import { agentSecurity, getSecuritySettings, updateSecuritySettings, authPolicy } from '../api.js';
   import AgentSecurityAllowlistEditor from './AgentSecurityAllowlistEditor.svelte';
   import Toggle from '../components/Toggle.svelte';
@@ -19,6 +19,7 @@
 
   let calendarFeedEnabled = $state(true);
   let pluginCliExecEnabled = $state(false);
+  let allowExternalImages = $state(false);
   let allowUserManagedAgents = $state(false);
   let maxAgentsPerUser = $state(5);
   let workspaceManagedAgents = $state(true);
@@ -111,6 +112,7 @@
       const settings = await getSecuritySettings();
       calendarFeedEnabled = settings.calendar_feed_enabled ?? true;
       pluginCliExecEnabled = settings.plugin_cli_exec_enabled ?? false;
+      allowExternalImages = settings.allow_external_images ?? false;
       allowUserManagedAgents = settings.allow_user_managed_agents ?? false;
       maxAgentsPerUser = settings.max_agents_per_user ?? 5;
       workspaceManagedAgents = settings.workspace_managed_agents ?? true;
@@ -151,15 +153,18 @@
       await updateSecuritySettings({
         calendar_feed_enabled: calendarFeedEnabled,
         plugin_cli_exec_enabled: pluginCliExecEnabled,
+        allow_external_images: allowExternalImages,
         allow_user_managed_agents: allowUserManagedAgents,
         max_agents_per_user: maxAgentsPerUser,
         workspace_managed_agents: workspaceManagedAgents,
         api_key_creation_policy: apiKeyCreationPolicy,
         api_key_allowed_group_ids: apiKeyAllowedGroupIds
       });
+      return true;
     } catch (err) {
       errorToast(t('settings.security.failedToSave'));
       console.error('Failed to save settings:', err);
+      return false;
     } finally {
       saving = false;
     }
@@ -192,6 +197,13 @@
     await saveSettings();
   }
 
+  async function handleExternalImagesToggle(newValue) {
+    allowExternalImages = newValue;
+    if (!(await saveSettings())) {
+      allowExternalImages = !newValue;
+    }
+  }
+
   async function handleUserManagedAgentsToggle(newValue) {
     allowUserManagedAgents = newValue;
     await saveSettings();
@@ -290,6 +302,45 @@
       </div>
     </Panel>
 
+    <!-- External Markdown Images -->
+    <div class="mt-4">
+      <Panel padding="spacious">
+        <div class="flex items-start gap-4">
+          <div class="p-2 rounded-lg" style="background-color: var(--ds-background-neutral);">
+            <ImageIcon class="w-5 h-5" style="color: var(--ds-icon);" />
+          </div>
+          <div class="min-w-0 flex-1">
+            <div class="flex items-center justify-between gap-4">
+              <div class="min-w-0">
+                <h3 class="text-base font-medium" style="color: var(--ds-text);">
+                  {t('settings.security.externalImages')}
+                </h3>
+                <p class="text-sm mt-1" style="color: var(--ds-text-subtle);">
+                  {t('settings.security.externalImagesDesc')}
+                </p>
+                <p class="text-xs mt-2" style="color: var(--ds-text-subtle);">
+                  {t('settings.security.externalImagesRefresh')}
+                </p>
+              </div>
+              <Toggle
+                bind:checked={allowExternalImages}
+                ariaLabel={t('settings.security.externalImages')}
+                dataTestid="external-images-toggle"
+                disabled={saving}
+                onchange={handleExternalImagesToggle}
+              />
+            </div>
+
+            {#if allowExternalImages}
+              <div class="mt-3">
+                <AlertBox variant="warning" message={t('settings.security.externalImagesWarning')} />
+              </div>
+            {/if}
+          </div>
+        </div>
+      </Panel>
+    </div>
+
     <!-- Plugin CLI Execution Settings -->
     <div class="mt-4">
       <Panel padding="spacious">

frontend/src/lib/utils/markdown-url-policy.ts

@@ -0,0 +1,45 @@
+const rasterDataURI = /^data:image\/(?:png|jpeg|gif|webp);base64,[a-z0-9+/]+=*$/i;
+
+const commonURLSchemes = ['http', 'https'] as const;
+const linkOnlyURLSchemes = ['mailto', 'tel'] as const;
+
+export const markdownURLSchemes = [
+  ...commonURLSchemes,
+  ...linkOnlyURLSchemes,
+  'page',
+  'data',
+] as const;
+
+const commonSchemes = new Set<string>(commonURLSchemes);
+const linkOnlySchemes = new Set<string>(linkOnlyURLSchemes);
+
+function hasUnsafeCharacters(value: string): boolean {
+  if (value.includes('\\') || /%5c/i.test(value)) return true;
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code <= 0x20 || code === 0x7f) return true;
+  }
+  return false;
+}
+
+type MarkdownURLOptions = {
+  image?: boolean;
+  allowBlobImage?: boolean;
+};
+
+/** Validate Markdown destinations used by readonly rendering and the editor. */
+export function isSafeMarkdownURL(
+  value: string,
+  { image = false, allowBlobImage = false }: MarkdownURLOptions = {}
+): boolean {
+  if (!value || value.startsWith('//') || hasUnsafeCharacters(value)) return false;
+  if (value.startsWith('#') || value.startsWith('/')) return true;
+  if (image && rasterDataURI.test(value)) return true;
+  if (image && allowBlobImage && /^blob:https?:/i.test(value)) return true;
+
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(value)?.[1]?.toLowerCase();
+  if (!scheme) return /^[^/:?#\\][^:\\]*$/.test(value);
+  if (commonSchemes.has(scheme)) return true;
+  if (!image && linkOnlySchemes.has(scheme)) return true;
+  return !image && scheme === 'page' && /^page:[0-9]+$/i.test(value);
+}