Post #3226164
2026-06-03 15:12 UTC
@sash@hachyderm.io Excellent write-up!
While reading, I had the thought of possible mitigation in the #meshcore firmware, such as dropping adverts that contain node names with "http://". But TIL, relative URIs allow omitting the scheme.
So ultimately, sanitizing the node names before presentation is the most robust solution, exactly as your write-up concludes.
Replies (2)
-
@litchralee_v6@ipv6.social 2026-06-03 15:14
Ref: https://datatracker.ietf.org/doc/html/rfc3986#section-5.1
-
@sash@hachyderm.io 2026-06-03 15:23
@litchralee_v6@ipv6.social yes, also because HTML is just one option. Maybe someone puts them in SQL, or LDAP, or shell. Only the code that prepares it for a particular context can know how to make it safe.