From 747d9b05f9ac2b1ea0d229b766b22814cc4514d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C5=ABdolfs=20O=C5=A1i=C5=86=C5=A1?= <rudolfs@osins.org>
Date: Fri, 22 May 2026 12:01:46 +0200
Subject: [PATCH] Restrict job log links to http(s) URLs

---
 src/components/JobCob.svelte | 27 ++++++++++++---------------
 src/lib/utils.ts             | 12 ++++++++++++
 2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/src/components/JobCob.svelte b/src/components/JobCob.svelte
index 1592e9b5e..7f9e3dfec 100644
--- a/src/components/JobCob.svelte
+++ b/src/components/JobCob.svelte
@@ -24,6 +24,8 @@
 </script>
 
 <script lang="ts">
+  import { safeHttpUrl } from "@app/lib/utils";
+
   import Button from "@app/components/Button.svelte";
   import Icon from "@app/components/Icon.svelte";
   import Loading from "@app/components/Loading.svelte";
@@ -42,7 +44,7 @@
   type RunView = {
     run: Run;
     label: string;
-    linkable: boolean;
+    safeLog: string | undefined;
   };
 
   type HostGroup = {
@@ -73,13 +75,6 @@
     }
   }
 
-  function isLinkable(url: URL | undefined): boolean {
-    if (!url) return false;
-    if (url.protocol !== "http:" && url.protocol !== "https:") return false;
-    if (url.host === "no.url.example.com") return false;
-    return true;
-  }
-
   function runLabel(run: Run, url: URL | undefined): string {
     if (url && url.host === "github.com") {
       const m = url.pathname.match(/\/actions\/runs\/(\d+)/);
@@ -134,10 +129,12 @@
       for (const run of job.runs) {
         const url = parseUrl(run.log);
         const host = url && url.host ? url.host : "(unknown host)";
+        const safeLog =
+          url?.host !== "no.url.example.com" ? safeHttpUrl(run.log) : undefined;
         const view: RunView = {
           run,
           label: runLabel(run, url),
-          linkable: isLinkable(url),
+          safeLog,
         };
         const key = run.node.id;
         let entry = byNode[key];
@@ -375,12 +372,12 @@
             {#if !isCollapsed}
               {#if group.flatRuns}
                 {#each group.flatRuns as view (view.run.runId)}
-                  {#if view.linkable}
+                  {#if view.safeLog}
                     <a
                       class="row run-row"
-                      href={view.run.log}
+                      href={view.safeLog}
                       target="_blank"
-                      rel="noreferrer">
+                      rel="noopener noreferrer">
                       <span class="chip {view.run.status}">
                         {#if view.run.status === "succeeded"}
                           <Icon name="checkmark" />
@@ -419,12 +416,12 @@
                 {#each group.hosts as host}
                   <div class="row host-row"><span>{host.host}</span></div>
                   {#each host.runs as view (view.run.runId)}
-                    {#if view.linkable}
+                    {#if view.safeLog}
                       <a
                         class="row run-row"
-                        href={view.run.log}
+                        href={view.safeLog}
                         target="_blank"
-                        rel="noreferrer">
+                        rel="noopener noreferrer">
                         <span class="chip {view.run.status}">
                           {#if view.run.status === "succeeded"}
                             <Icon name="checkmark" />
diff --git a/src/lib/utils.ts b/src/lib/utils.ts
index 983677aa7..291a8998b 100644
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -224,6 +224,18 @@ export function isOnion(addr: string): boolean {
   return addr.endsWith(".onion");
 }
 
+export function safeHttpUrl(url: string): string | undefined {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return parsed.toString();
+    }
+  } catch {
+    // fall through
+  }
+  return undefined;
+}
+
 // Get the gravatar URL of an email.
 export function gravatarURL(email: string): string {
   const address = email.trim().toLowerCase();