test(ui): reject base64 SVG data URLs

2026-03-12 07:20:45 +00:00 · 2026-02-24 22:00:56 +00:00
parent e7298b844f
commit 30cb849b10
1 changed files with 12 additions and 0 deletions
--- a/ui/src/ui/open-external-url.test.ts
+++ b/ui/src/ui/open-external-url.test.ts
@@ -55,6 +55,18 @@ describe("resolveSafeExternalUrl", () => {
    ).toBeNull();
  });

+  it("rejects base64-encoded SVG data image URLs", () => {
+    expect(
+      resolveSafeExternalUrl(
+        "data:image/svg+xml;base64,PHN2ZyB4bWxucz0naHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmcnIC8+",
+        baseHref,
+        {
+          allowDataImage: true,
+        },
+      ),
+    ).toBeNull();
+  });
+
  it("rejects data image URLs unless explicitly enabled", () => {
    expect(resolveSafeExternalUrl("data:image/png;base64,iVBORw0KGgo=", baseHref)).toBeNull();
  });