Filter unsafe WebFetch HTML hrefs

Author: SqlRush

docs/first-second-parity-audit.md

@@ -123,7 +123,7 @@ Covered behavior:
 - `Bash` initial shell execution, including command/timeout/description validation, `/bin/sh -c` execution, stdout/stderr/exit-code/timeout structured results, dynamic read-only/concurrency-safe/destructive classification, Git diff/log/show/status/ls-files/grep/rev-parse/branch/tag/ls-remote safe-flag validation, Git remote/push/reflog/stash/worktree/merge-base/describe/cat-file/for-each-ref/rev-list/blame/shortlog/config-get argument-aware safety classification, conservative read-only `sed` and `awk` classification for safe print/delete/quit/line-number or field-print scripts over relative paths, safe relative-path `head`/`tail`/`cut`/`uniq` reads with `tail` follow modes excluded from read-only auto-allow, simple safe `sort` reads, destructive `find -delete/-exec rm` and `xargs rm` classification, safe-wrapper/env prefix normalization for Bash read-only/destructive classification (`time`/`nohup`/`timeout`/`nice`/`stdbuf`/`env`), destructive command detection after temporary environment assignments, permission-rule matching through the existing tool permission adapter, background command start, same-session `BashOutput` reads, and `KillBash` cancellation.
 - `TodoWrite` initial todo state, including full-list writes, status/priority validation, duplicate-id rejection, one `in_progress` guard, structured result payloads, tool metadata state storage, and session-scoped local persistence/restore.
 - `WebFetch` initial URL fetch behavior, including URL/timeout/max-byte validation, HTTP GET, HEAD preflight, metadata/raw `skipWebFetchPreflight` skip-preflight, binary preflight GET skipping from content type or attachment filename, text/binary detection, truncation, non-2xx error marking, structured result payloads, HTML-to-text rendering, prompt-focused excerpts, prompt phrase scoring/metadata, and `WebFetch(domain:...)` permission-rule adaptation.
-- `WebFetch` HTML-to-text rendering now preserves anchor `href` values as link context and emits visible image text from `img` `alt`/`title`/`aria-label` plus `src`, the first usable `img srcset` candidate, common lazy image `data-src`/`data-srcset` candidates, or a `<picture><source srcset>` candidate, allowing prompt-focused excerpts to match image descriptions while avoiding duplicate URL link text and `javascript:` hrefs plus `data:` image placeholders.
+- `WebFetch` HTML-to-text rendering now preserves anchor `href` values as link context and emits visible image text from `img` `alt`/`title`/`aria-label` plus `src`, the first usable `img srcset` candidate, common lazy image `data-src`/`data-srcset` candidates, or a `<picture><source srcset>` candidate, allowing prompt-focused excerpts to match image descriptions while avoiding duplicate URL link text, unsafe `javascript:`/`data:`/`blob:`/`vbscript:` hrefs, and `data:` image placeholders.
 - `WebFetch` GET records the redirect-resolved `final_url`, and HTML rendering resolves relative anchor/image URLs against that final URL or the document's first valid `<base href>` so redirected pages expose browser-visible link and image targets.
 - `WebFetch` text bodies now decode common web charsets from BOM, `Content-Type`, or HTML `<meta charset>`/`http-equiv` declarations, including UTF-8/UTF-16LE/UTF-16BE, Latin-1, and Windows-1252, and structured results expose the normalized `charset`.
 - `WebSearch` initial HTML/JSON-search adapter, including query/max-result/timeout/domain-filter validation, injectable search endpoint, DuckDuckGo HTML link parsing, HTML JSON-LD ItemList extraction, DuckDuckGo subdomain redirect unwrapping, common JSON result shapes plus nested backend wrappers such as `web`/`response`/`hits`/`documents`, DuckDuckGo result snippet extraction, domain allow/block filtering, structured result payloads, and query-based permission-rule matching.

internal/tools/web/web_fetch.go

@@ -610,7 +610,7 @@ func webFetchHTMLBaseURL(body string, fallback string) string {
 
 func resolveWebFetchBaseURL(raw string, fallback string) string {
 	raw = strings.TrimSpace(raw)
-	if raw == "" || strings.HasPrefix(strings.ToLower(raw), "javascript:") {
+	if raw == "" || hasUnsafeWebFetchHTMLURLScheme(raw) {
 		return ""
 	}
 	parsed, err := url.Parse(raw)
@@ -642,7 +642,7 @@ func appendHTMLWebFetchAnchorHref(b *strings.Builder, anchors []htmlWebFetchAnch
 	anchor := anchors[len(anchors)-1]
 	anchors = anchors[:len(anchors)-1]
 	href := strings.TrimSpace(anchor.Href)
-	if href == "" || strings.HasPrefix(href, "#") || strings.HasPrefix(strings.ToLower(href), "javascript:") {
+	if href == "" || strings.HasPrefix(href, "#") || hasUnsafeWebFetchHTMLURLScheme(href) {
 		return anchors, false
 	}
 	text := ""
@@ -766,7 +766,7 @@ func resolveWebFetchHTMLURL(raw string, baseURL string) string {
 	if raw == "" || strings.HasPrefix(raw, "#") {
 		return raw
 	}
-	if strings.HasPrefix(strings.ToLower(raw), "javascript:") {
+	if hasUnsafeWebFetchHTMLURLScheme(raw) {
 		return ""
 	}
 	parsed, err := url.Parse(raw)
@@ -783,6 +783,20 @@ func resolveWebFetchHTMLURL(raw string, baseURL string) string {
 	return base.ResolveReference(parsed).String()
 }
 
+func hasUnsafeWebFetchHTMLURLScheme(raw string) bool {
+	idx := strings.IndexByte(raw, ':')
+	if idx <= 0 {
+		return false
+	}
+	scheme := strings.ToLower(strings.TrimSpace(raw[:idx]))
+	switch scheme {
+	case "javascript", "data", "blob", "vbscript":
+		return true
+	default:
+		return false
+	}
+}
+
 func htmlWebFetchAttr(rawTag string, name string) string {
 	name = strings.ToLower(strings.TrimSpace(name))
 	for _, match := range htmlWebFetchAttrRe.FindAllStringSubmatch(rawTag, -1) {

internal/tools/web/web_fetch_test.go

@@ -242,6 +242,9 @@ func TestWebFetchHTMLRenderingPreservesLinksAndImageText(t *testing.T) {
       <img alt="Picture data placeholder" src="/assets/picture-fallback.png">
     </picture>
     <a href="javascript:alert(1)">ignored script link</a>
+    <a href="data:text/plain;base64,SGVsbG8=">ignored data link</a>
+    <a href="blob:https://example.com/asset-id">ignored blob link</a>
+    <a href="vbscript:msgbox(1)">ignored vbscript link</a>
   </main>
 </body>
 </html>`))
@@ -290,7 +293,8 @@ func TestWebFetchHTMLRenderingPreservesLinksAndImageText(t *testing.T) {
 	if !strings.Contains(rendered, "Image: Picture data placeholder ("+server.URL+"/assets/picture-real.png)") {
 		t.Fatalf("rendered body missing data-placeholder picture source text: %#v", rendered)
 	}
-	if strings.Contains(rendered, "javascript:alert") || strings.Contains(rendered, "data:image") || strings.Contains(rendered, "R0lGOD") {
+	if strings.Contains(rendered, "javascript:alert") || strings.Contains(rendered, "data:image") || strings.Contains(rendered, "R0lGOD") ||
+		strings.Contains(rendered, "data:text/plain") || strings.Contains(rendered, "blob:https://") || strings.Contains(rendered, "vbscript:") {
 		t.Fatalf("rendered body kept unsafe href: %#v", rendered)
 	}
 	excerpt, ok := result.StructuredContent["prompt_excerpt"].(string)