fix(Markdown): reject all data: schemes in parser isSafeUrl (#6323) by ManoharPaturi · Pull Request #6355 · facebook/astryx

ManoharPaturi · 2026-09-17T06:53:18Z

Summary

The doc comment on isSafeUrl in packages/core/src/Markdown/parser.ts states:

Reject URLs with dangerous schemes (javascript:, vbscript:, data:) that could execute arbitrary code when rendered as link hrefs or image srcs.

However, isSafeUrl was previously only testing lower.startsWith('data:text/html'). This allowed arbitrary other dangerous data schemes (such as data:image/svg+xml,<svg onload=alert(1)>) to pass through the public parser and appear as link/image nodes in the AST.

In contrast, the renderer's sanitizeUrl in Markdown.tsx uses DANGEROUS_URL_PATTERN = /^(javascript|data|vbscript):/i, which rejects all data: URLs.

Changes

Updated isSafeUrl in packages/core/src/Markdown/parser.ts to reject all data: schemes with lower.startsWith('data:'), aligning the parser implementation with its documented contract and with Markdown.tsx.
Exported isSafeUrl from packages/core/src/Markdown/parser.ts for testability and public consumer verification.
Added comprehensive unit tests in packages/core/src/Markdown/parser.test.ts covering:
- Direct rejection in isSafeUrl for data:image/svg+xml, data:image/png, data:text/plain, and data:text/html.
- Rejection of data:image/svg+xml links and data:image/png images in parseInline (preserved as literal text).
Added changeset .changeset/fix-markdown-parser-is-safe-url-data.md.

Verification

bun test packages/core/src/Markdown/parser.test.ts passed: 144 passed, 0 failed.
bunx prettier --check passed on all modified files.

Signed-off-by: Manohar Paturi <186662190+ManoharPaturi@users.noreply.github.com>

vercel · 2026-09-17T06:53:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astryx	Ready	Preview	Sep 17, 2026 6:57am UTC

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

astracat-bot · 2026-09-17T06:53:42Z

AI review status for this pull request.

Review status	Updated
⏳ Waiting for review (for maintainers only)	Sep 18, 2026, 2:09 AM UTC

github-actions · 2026-09-17T08:07:35Z

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

Package	Size (ESM)	Size (CJS)	Gzipped
@astryxdesign/core	N/A	4.8KB	1.2KB

Accessibility Audit

Status: 36 accessibility violation(s) found — 2 critical, 34 serious.

Button pattern - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/18 stories · Learn more
- WCAG: 1.4.3 (Level AA)

ChatComposer - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/18 stories · Learn more
- WCAG: 1.4.3 (Level AA)

ChatComposerInput - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/14 stories · Learn more
- WCAG: 1.4.3 (Level AA)

ChatReasoning - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 4/5 stories · Learn more
- WCAG: 1.4.3 (Level AA)

ChatToolCalls - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 10/11 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Checkbox pattern - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/33 stories · Learn more
- WCAG: 1.4.3 (Level AA)

CheckboxList - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 4/17 stories · Learn more
- WCAG: 1.4.3 (Level AA)

ClickableCard - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/5 stories · Learn more
- WCAG: 1.4.3 (Level AA)

CodeEditor - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 3/7 stories · Learn more
- WCAG: 1.4.3 (Level AA)

CodeEditorPerf - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/2 stories · Learn more
- WCAG: 1.4.3 (Level AA)

CodeEditorTheme - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 13/14 stories · Learn more
- WCAG: 1.4.3 (Level AA)

CodeTheme - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 14/16 stories · Learn more
- WCAG: 1.4.3 (Level AA)

DateRangeInput - 1 issue(s)

🔴 critical: Ensure an element's role supports its ARIA attributes
- Rule: aria-allowed-attr · Affects 1/21 stories · Learn more
- WCAG: 4.1.2 (Level A)

FileInput - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 3/15 stories · Learn more
- WCAG: 1.4.3 (Level AA)

GridMasonry - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/3 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Heading - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/16 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Icon - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/18 stories · Learn more
- WCAG: 1.4.3 (Level AA)

LogStream - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/3 stories · Learn more
- WCAG: 1.4.3 (Level AA)

MediaTheme Auto - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/5 stories · Learn more
- WCAG: 1.4.3 (Level AA)

PowerSearch - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/26 stories · Learn more
- WCAG: 1.4.3 (Level AA)

ProgressBar - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/18 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Radio group pattern - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 3/26 stories · Learn more
- WCAG: 1.4.3 (Level AA)

RadioList - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 3/13 stories · Learn more
- WCAG: 1.4.3 (Level AA)

RichTextEditor - 2 issue(s)

🟠 serious: Ensure every ARIA input field has an accessible name
- Rule: aria-input-field-name · Affects 2/18 stories · Learn more
- WCAG: 4.1.2 (Level A)
🔴 critical: Ensure every form element has a label
- Rule: label · Affects 1/18 stories · Learn more
- WCAG: 4.1.2 (Level A)

SelectableCard - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/4 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Stepper - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/30 stories · Learn more
- WCAG: 1.4.3 (Level AA)

TableGroupedRows - 1 issue(s)

🟠 serious: Ensure ARIA attributes are used as described in the specification of the element's role
- Rule: aria-conditional-attr · Affects 3/3 stories · Learn more
- WCAG: 4.1.2 (Level A)

TableTree - 1 issue(s)

🟠 serious: Ensure ARIA attributes are used as described in the specification of the element's role
- Rule: aria-conditional-attr · Affects 8/9 stories · Learn more
- WCAG: 4.1.2 (Level A)

Text - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/23 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Theme - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/5 stories · Learn more
- WCAG: 1.4.3 (Level AA)

PopArt - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 3/6 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Thumbnail - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/12 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Timestamp - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 1/20 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Token - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/10 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Tokenizer - 1 issue(s)

🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
- Rule: color-contrast · Affects 2/24 stories · Learn more
- WCAG: 1.4.3 (Level AA)

Visual Regression

Status: No visual change across 4 compared shot(s).

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}

fix(Markdown): reject all data: URL schemes in parser isSafeUrl

6729465

Signed-off-by: Manohar Paturi <186662190+ManoharPaturi@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings September 17, 2026 06:53

ManoharPaturi requested review from cixzhang, imdreamrunner and josephfarina as code owners September 17, 2026 06:53

meta-cla Bot added the CLA Signed This label is managed by the Meta Open Source bot. label Sep 17, 2026

Copilot AI reviewed Sep 17, 2026

github-actions Bot added community Authored by a community contributor (not on the eng/design team) needs:code-review High-risk change (new package/component/API) — needs human code review before merge labels Sep 17, 2026

vercel Bot deployed to Preview September 17, 2026 06:57 View deployment

github-actions Bot added a commit that referenced this pull request Sep 17, 2026

Deploy PR #6355 preview

0901600

Navigation Menu

fix(Markdown): reject all data: schemes in parser isSafeUrl (#6323) - #6355

fix(Markdown): reject all data: schemes in parser isSafeUrl (#6323)#6355
ManoharPaturi wants to merge 1 commit into
facebook:mainfrom
ManoharPaturi:fix/parser-is-safe-url-data

ManoharPaturi commented Sep 17, 2026

Uh oh!

vercel Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

astracat-bot Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ManoharPaturi commented Sep 17, 2026

Summary

Changes

Verification

Uh oh!

vercel Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

astracat-bot Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026

PR Analysis Report

📚 Storybook Preview

🧪 Sandbox Preview

Bundle Size Summary

Accessibility Audit

Visual Regression

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Sep 17, 2026 •

edited

Loading

astracat-bot Bot commented Sep 17, 2026 •

edited

Loading