Add URL validation and DOMPurify sanitization to Discogs markup parser

[Copilot]

Addresses XSS vulnerability in Discogs markup parsing where unsanitized user content from the Discogs API could be injected into the DOM through [url] tags and link text.

Changes

Added DOMPurify dependency

• Provides trusted HTML sanitization for user-provided content

Implemented sanitizeUrl() function

• Validates URL format using native URL API
• Restricts protocols to http:, https:, ftp: only
• Returns safe placeholder # for invalid/malicious URLs (e.g., javascript:, data:)
• Decodes HTML entities before validation

Sanitized all user-controlled strings

• Link text in [url=...]text[/url] tags stripped of HTML
• Display names in [a=name] search links stripped of HTML
• Display URLs in [url]...[/url] tags use validated URL

Example

Before:

// Vulnerable to XSS
result.replace(/\[url=(.*?)\](.*?)\[\/url\]/gi, 
  '<a href="$1">$2</a>');

After:

// Sanitized and validated
result.replace(/\[url=(.*?)\](.*?)\[\/url\]/gi, (_, url, text) => {
  const sanitizedUrl = sanitizeUrl(url);  // Protocol validation
  const sanitizedText = DOMPurify.sanitize(text, { ALLOWED_TAGS: [] });
  return `<a href="${sanitizedUrl}">${sanitizedText}</a>`;
});

Blocks: javascript:alert(1), data:text/html,<script>..., <img onerror=alert(1)>

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​dompurify@​3.0.5
	dompurify@​3.3.1

View full report