mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-25 10:39:01 -06:00
jcl-bitandClaude Opus 5.5
cc7694be99
A document could open any address with no confirmation: a link click, a push button's URI action, a one-line button script mapped to a URI action, or app.launchURL from JavaScript (on by default). That allowed sending form data to an outside site, or handing file:, smb: and app-handler addresses to the operating system. All four now go through PdfCraftApp::request_document_url: - engine::links::document_url accepts only http, https and mailto, up to 2048 characters, and refuses control, zero-width, bidi-override and non-space whitespace characters, malformed schemes and web addresses without a host. - Accepted addresses wait in an "Open this web page?" dialog that shows the real host (engine::links::host drops user:password@, and treats \ like / as browsers do, so https://a.example\@b.example shows a.example) and the full address. Cancel is the highlighted button; Escape and clicking outside cancel. While one request waits, further ones are dropped, so a script can't stack dialogs. - Refused addresses are reported in a notice and never opened. PdfCraft's own links (Help, About, updates) still use open_url. Preferences > JavaScript now says scripts need permission to open a web page. Tests: engine unit tests for the policy and host parsing, and crates/ui-egui/tests/document_links.rs driving the link, button, button script, app.launchURL and Escape paths (all fail against the old code). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>