fix: only linkify digitalSourceType when it points to the IPTC registry - #49
Open
andyparsons wants to merge 1 commit into
Open
fix: only linkify digitalSourceType when it points to the IPTC registry#49andyparsons wants to merge 1 commit into
andyparsons wants to merge 1 commit into
Conversation
digitalSourceType is signer-controlled free text, so rendering it as an unconditional clickable link let a malicious manifest turn the report into a phishing redirect. Only linkify http(s) values hosted on cv.iptc.org (the registry C2PA actually references); everything else renders as plain text. Closes #46 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R9UcEM7BT3vwtX63A1bBhG
✅ Deploy Preview for c2pa-conformulator ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
tmathern
approved these changes
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
digitalSourceTypeis signer-controlled free text on the manifest, but the report rendered it as an unconditional clickable link, so any value (e.g.google.com, or a phishing URL) became a live, unlabeled hyperlink presented as if it were vetted data.http(s)://cv.iptc.org/...URL — the registry C2PA actually references for this field. Everything else (other domains, non-URL text, dangerous schemes likejavascript:) renders as plain text instead.Closes #46
Test plan
npx vitest run src/lib/ReportViewer.test.ts— newisTrustedDigitalSourceTypeUrlcases cover trusted IPTC URLs, other domains (incl. lookalike hosts), dangerous schemes, and non-URL textnpm run check— no new type errors introduced🤖 Generated with Claude Code
https://claude.ai/code/session_01R9UcEM7BT3vwtX63A1bBhG