{"action":"created","issue":{"url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/issues/1350","labels_url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/issues/1350/labels{/name}","comments_url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/issues/1350/comments","events_url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/issues/1350/events","html_url":"https://github.com/Jermolene/TiddlyWiki5/issues/1350","id":53959585,"number":1350,"title":"Disallow `javascript:` urls","user":{"login":"Jermolene","id":174761,"avatar_url":"https://avatars.githubusercontent.com/u/174761?v=3","gravatar_id":"","url":"https://api.github.com/users/Jermolene","html_url":"https://github.com/Jermolene","followers_url":"https://api.github.com/users/Jermolene/followers","following_url":"https://api.github.com/users/Jermolene/following{/other_user}","gists_url":"https://api.github.com/users/Jermolene/gists{/gist_id}","starred_url":"https://api.github.com/users/Jermolene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jermolene/subscriptions","organizations_url":"https://api.github.com/users/Jermolene/orgs","repos_url":"https://api.github.com/users/Jermolene/repos","events_url":"https://api.github.com/users/Jermolene/events{/privacy}","received_events_url":"https://api.github.com/users/Jermolene/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/labels/bug","name":"bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-10T14:25:17Z","updated_at":"2015-01-11T08:49:32Z","closed_at":null,"body":"The use of JavaScript pseudo-URLs makes it possible to include executable JavaScript in wiki text. For example:\r\n\r\n```\r\n<a href=\"javascript:alert('boo')\">Click</a>\r\n```\r\n\r\nThis is undesirable because it means that any wiki text tiddler could contain malicious JavaScript. TiddlyWiki5 requires all executable JavaScript to be in tiddler modules that can easily be filtered during imports/upgrades.\r\n\r\nThese `javascript:` URLs should be filtered so that they are not executed.\r\n"},"comment":{"url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/issues/comments/69487633","html_url":"https://github.com/Jermolene/TiddlyWiki5/issues/1350#issuecomment-69487633","issue_url":"https://api.github.com/repos/Jermolene/TiddlyWiki5/issues/1350","id":69487633,"user":{"login":"Jermolene","id":174761,"avatar_url":"https://avatars.githubusercontent.com/u/174761?v=3","gravatar_id":"","url":"https://api.github.com/users/Jermolene","html_url":"https://github.com/Jermolene","followers_url":"https://api.github.com/users/Jermolene/followers","following_url":"https://api.github.com/users/Jermolene/following{/other_user}","gists_url":"https://api.github.com/users/Jermolene/gists{/gist_id}","starred_url":"https://api.github.com/users/Jermolene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jermolene/subscriptions","organizations_url":"https://api.github.com/users/Jermolene/orgs","repos_url":"https://api.github.com/users/Jermolene/repos","events_url":"https://api.github.com/users/Jermolene/events{/privacy}","received_events_url":"https://api.github.com/users/Jermolene/received_events","type":"User","site_admin":false},"created_at":"2015-01-11T08:49:32Z","updated_at":"2015-01-11T08:49:32Z","body":"We already block JavaScript within wiki text: both the `<script>` tag and any event attributes like `onclick` are suppressed. The fact that JavaScript URIs work right now is an oversight.\r\n\r\nThe reason is really simple. We want to be able to build multi-user systems with TiddlyWiki: both TiddlyWeb-style centralised systems, and federated systems. In either case, it is not unacceptable for viewing one of your tiddlers to run the risk of executing your JavaScript.\r\n\r\nSo we go to some trouble to make sure that executable JavaScript can only be included within tiddler modules, which allows us to sandbox or filter its execution.\r\n\r\nNo serious multiuser wiki allows for embedded JavaScript within wikitext for this same reason.\r\n\r\n> In a way mat is rather right. If some code wants harm done, it wants harm done. Whether we undergo a save/relaoad cycle or run that immediately, what's the difference?\r\n\r\nThis is nothing to do with the save/reload cycle. This is to do with being able to identify and therefore filter/sandbox executable JavaScript.\r\n"}}