don't redirect to data: and javascript: protocols/schemes

[g-k]

https://pageshot.net/redirect?to=javascript:confirm(2)

CSP catches the javascript: uri, but then the link doesn't work. Old browsers that don't support CSP would redirect.

http://pageshot.net/redirect?to=data:text/html;charset=utf8;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K

data: is whitelisted in CSP, but this still requires an extra reload and is filtered by noscript if it's installed.

The XSS payloads aren't executed on a pageshot domain, so this is more of a usability issue or product decision.

Since these protocols can't be pageshot anyway (data: triggers ------Error in promise: Error: No window matching {"matchesHost":["<all_urls>"]} and the browser won't load javascript: domains directly) I'd recommend not redirecting to them and whitelisting http and https domains initially. Warning before redirecting to them OK but less desirable too.

I'd also recommend swapping DOMPurify for escape-html for HTML escaping, since it's more actively maintained.

[ianb]

Note that we now also are showing only origins and not full URLs, and in the process we don't save any path for non-http(s) URLs. but that's only done on the add-on. Leaving this open to handle this even when malicious JSON is submitted.

[g-k]

In Chrome and Safari, the XSS runs without reloading the domain.

[ianb]

Redirection has been removed