fix(security): reject unsafe link schemes

[smiggleworth]

Closes #129

Rejects javascript, data, vbscript, file, and obfuscated executable href schemes across Link, client intrinsic attributes, and SSR output. Safe documented schemes and relative URLs remain supported.

Verification:

• focused unsafe-href tests: 7 passed
• architecture tests: 13 passed
• npm run check: passed

[Copilot]

Pull request overview

This PR introduces a shared URL-scheme allowlist for href values to prevent executable/local-file schemes from reaching client rendering, Link, and SSR attribute output.

Changes:

• Added isSafeHref() (allowlist) for validating/sanitizing href values.
• Enforced the policy in Link, the client intrinsic attribute renderer, and SSR attribute rendering.
• Added jsdom regression coverage for unsafe href schemes across Link, client output, and SSR output.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/common/url.ts	Defines shared href scheme allowlist helper (isSafeHref).
src/components/link.tsx	Throws when Link receives an unsafe href.
src/renderer/attributes.ts	Omits unsafe href values when applying intrinsic props in the client renderer.
src/ssr/attrs.ts	Omits unsafe href values during SSR attribute rendering.
tests/jsdom/renderer/unsafe-href.test.tsx	Adds regression tests for unsafe href schemes across Link, client rendering, and SSR.

Comments suppressed due to low confidence (2)

src/ssr/attrs.ts:188

• Same case-sensitivity issue exists in renderAttrs() (string path): attrName === 'href' can be bypassed with mixed/upper-case keys (e.g. spread props containing HREF). This should be case-insensitive to match HTML behavior.

    } else {
      const strValue = String(value);
      if (attrName === 'href' && !isSafeHref(strValue)) continue;
      attrParts.push(` ${attrName}="${getEscapedAttrValue(strValue)}"`);

src/renderer/attributes.ts:361

• applyScalarPropValue() has the same case-sensitive href check as the static path. This leaves a bypass via spread props with HREF/mixed casing, which will still be rendered as href for HTML elements. Make the check case-insensitive.

  } else if (key === 'value' || key === 'checked') {
    applyFormControlProp(el, key, value, tagName);
  } else if (key === 'href' && !isSafeHref(String(value))) {
    removeRenderedAttribute(el, key);
  } else {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.