Harden reader links and temporary signing files with regression checks

Author: decoder-dev

.github/workflows/build.yml

@@ -50,6 +50,10 @@ jobs:
           node-version: '22'
       - name: Accessibility contracts
         run: python3 -m unittest discover -s Tests/VoiceOverContracts
+      - name: Reader links and signing key cleanup
+        run: |
+          node --test Tests/Readability/links.test.cjs
+          python3 -m unittest discover -s Tests/BuildTools
       - name: MTProto malformed-input regression tests
         run: |
           clang -fobjc-arc -framework Foundation -I submodules/MtProtoKit/PublicHeaders \

CHANGELOG.md

@@ -7,6 +7,7 @@
 ## [Unreleased]
 
 ### Fixed — release hardening, VLESS and media playback
+- Reader mode removes mixed-case and control-character-obfuscated JavaScript links. Build tools atomically create temporary files; signing keys are removed even when certificate repository loading fails.
 - Fixed libxray API v3 decoding: successful replies contain a JSON object in `data` and an empty `error` string. The previous adapter rejected successful calls, preventing the embedded runtime from starting.
 - Protected Saved Messages now shares Archive's ten-tap reveal and password/biometric gate; entries in Settings, chat lists, search, sharing, widgets and Spotlight are hidden while protected as appropriate to each surface.
 - Archive cleanup removes the actual protected controller instead of blindly popping the top screen, clears its privacy cover after cleanup, isolates authentication across account switches, rejects late unlock callbacks after relock and retains legacy hashes if Keychain migration has not succeeded.

Tests/BuildTools/test_signing_tempfile.py

@@ -0,0 +1,31 @@
+import ast
+import os
+import pathlib
+import tempfile
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+
+class SigningTemporaryFileTests(unittest.TestCase):
+    def test_key_is_private_and_deleted_after_clone_failure(self):
+        # Compile the real class without importing the unrelated macOS tooling.
+        tree = ast.parse((ROOT / 'build-system/Make/BuildConfiguration.py').read_text())
+        definition = next(n for n in tree.body if isinstance(n, ast.ClassDef) and n.name == 'GitCodesigningSource')
+        observed = []
+        def clone(**kwargs):
+            path = pathlib.Path(kwargs['temp_key_path'])
+            observed.append(path)
+            self.assertEqual(path.read_text(), 'test-only-private-key\n')
+            if os.name != 'nt':
+                self.assertEqual(path.stat().st_mode & 0o077, 0)
+            raise RuntimeError('simulated clone failure')
+        namespace = dict(os=os, tempfile=tempfile, CodesigningSource=object, load_codesigning_data_from_git=clone)
+        exec(compile(ast.Module(body=[definition], type_ignores=[]), 'BuildConfiguration.py', 'exec'), namespace)
+        source = namespace['GitCodesigningSource']('unused', 'test-only-private-key', 'team', 'bundle', 'adhoc', '', False)
+        with self.assertRaisesRegex(RuntimeError, 'simulated clone failure'):
+            source.load_data('unused')
+        self.assertEqual(len(observed), 1)
+        self.assertFalse(observed[0].exists())
+
+if __name__ == '__main__':
+    unittest.main()

Tests/Readability/links.test.cjs

@@ -0,0 +1,30 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const Readability = require('../../submodules/TelegramUI/Resources/Readability/Readability.js');
+
+function normalize(href) {
+  let removed = false, result = href;
+  const link = {
+    getAttribute: () => href,
+    setAttribute: (_, value) => { result = value; },
+    childNodes: [{ nodeType: 3 }], textContent: 'link text',
+    parentNode: { replaceChild: () => { removed = true; } },
+  };
+  const reader = Object.create(Readability.prototype);
+  reader._doc = { baseURI: 'https://example.com/article', documentURI: 'https://example.com/article', createTextNode: text => ({ text }) };
+  reader._getAllNodesWithTag = (_, tags) => tags[0] === 'a' ? [link] : [];
+  reader._fixRelativeUris({});
+  return { removed, result };
+}
+
+test('reader removes executable URLs with case and control-character obfuscation', () => {
+  for (const href of ['javascript:alert(1)', 'JaVaScRiPt:alert(1)', '  javascript:alert(1)', 'java\tscript:alert(1)', 'java\nscript:alert(1)', '\rjavascript:alert(1)']) {
+    assert.equal(normalize(href).removed, true, JSON.stringify(href));
+  }
+});
+
+test('reader preserves navigation links and resolves relative URLs', () => {
+  assert.deepEqual(normalize('../page'), { removed: false, result: 'https://example.com/page' });
+  assert.deepEqual(normalize('#section'), { removed: false, result: '#section' });
+  assert.equal(normalize('https://example.com/javascript:guide').removed, false);
+});

build-system/Make/BuildConfiguration.py

@@ -262,18 +262,19 @@ def __init__(self, repo_url, private_key, team_id, bundle_id, codesigning_type,
     def load_data(self, working_dir):
         self.working_dir = working_dir
         temp_key_path = None
-        if self.private_key is not None:
-            temp_key_path = tempfile.mktemp()
-            with open(temp_key_path, 'w+') as file:
-                file.write(self.private_key)
-                if not self.private_key.endswith('\n'):
-                    file.write('\n')
-            os.chmod(temp_key_path, 0o600)
-
-        load_codesigning_data_from_git(working_dir=self.working_dir, repo_url=self.repo_url, temp_key_path=temp_key_path, branch=self.team_id, password=self.password, always_fetch=self.always_fetch)
-
-        if temp_key_path is not None:
-            os.remove(temp_key_path)
+        try:
+            if self.private_key is not None:
+                key_fd, temp_key_path = tempfile.mkstemp()
+                with os.fdopen(key_fd, 'w+') as file:
+                    file.write(self.private_key)
+                    if not self.private_key.endswith('\n'):
+                        file.write('\n')
+                os.chmod(temp_key_path, 0o600)
+
+            load_codesigning_data_from_git(working_dir=self.working_dir, repo_url=self.repo_url, temp_key_path=temp_key_path, branch=self.team_id, password=self.password, always_fetch=self.always_fetch)
+        finally:
+            if temp_key_path is not None:
+                os.remove(temp_key_path)
 
     def copy_profiles_to_destination(self, destination_path):
         source_path = self.working_dir + '/decrypted/profiles/{}'.format(self.codesigning_type)

build-system/Make/GenerateProfiles.py

@@ -99,8 +99,8 @@ def get_certificate_base64_from_p12(p12_path, p12_password=''):
 
 def process_provisioning_profile(source, destination, certificate_data, signing_identity, keychain_name):
     parsed_plist = run_executable_with_output('security', arguments=['cms', '-D', '-i', source], check_result=True)
-    parsed_plist_file = tempfile.mktemp()
-    with open(parsed_plist_file, 'w+') as file:
+    plist_fd, parsed_plist_file = tempfile.mkstemp()
+    with os.fdopen(plist_fd, 'w+') as file:
         file.write(parsed_plist)
 
     # Remove all existing developer certificates

build-system/Make/RemoteBuild.py

@@ -144,8 +144,8 @@ def handle_ssh_credentials(credentials):
                 if watch_provisioning_profile_remote_path is not None:
                     guest_build_sh += '--watchProvisioningProfile="{}" \\'.format(watch_provisioning_profile_remote_path)
 
-            guest_build_file_path = tempfile.mktemp()
-            with open(guest_build_file_path, 'w+') as file:
+            guest_build_fd, guest_build_file_path = tempfile.mkstemp()
+            with os.fdopen(guest_build_fd, 'w+') as file:
                 file.write(guest_build_sh)
             session_scp_upload(session=session, source_path=guest_build_file_path, destination_path='guest-build-telegram.sh')
             os.unlink(guest_build_file_path)
@@ -222,8 +222,8 @@ def handle_ssh_credentials(credentials):
                 FASTLANE_PASSWORD="{password}" xcrun altool --upload-app --type ios --file "Telegram.ipa" --username "{username}" --password "@env:FASTLANE_PASSWORD"
             '''.format(username=username, password=password)
 
-            guest_upload_file_path = tempfile.mktemp()
-            with open(guest_upload_file_path, 'w+') as file:
+            guest_upload_fd, guest_upload_file_path = tempfile.mkstemp()
+            with os.fdopen(guest_upload_fd, 'w+') as file:
                 file.write(guest_upload_sh)
             session_scp_upload(session=session, source_path=guest_upload_file_path, destination_path='guest-upload-telegram.sh')
             os.unlink(guest_upload_file_path)
@@ -282,15 +282,16 @@ def handle_ssh_credentials(credentials):
                 echo $? > result.txt
             '''
 
-            guest_upload_file_path = tempfile.mktemp()
-            with open(guest_upload_file_path, 'w+') as file:
+            guest_upload_fd, guest_upload_file_path = tempfile.mkstemp()
+            with os.fdopen(guest_upload_fd, 'w+') as file:
                 file.write(guest_upload_sh)
             session_scp_upload(session=session, source_path=guest_upload_file_path, destination_path='guest-ipa-diff.sh')
             os.unlink(guest_upload_file_path)
 
             print('Executing remote ipa-diff...')
             session_ssh(session=session, command='bash -l guest-ipa-diff.sh')
-            guest_result_path = tempfile.mktemp()
+            guest_result_fd, guest_result_path = tempfile.mkstemp()
+            os.close(guest_result_fd)
             session_scp_download(session=session, source_path='result.txt', destination_path=guest_result_path)
             guest_result = ''
             with open(guest_result_path, 'r') as file:

build-system/Make/TartBuild.py

@@ -611,8 +611,8 @@ def remote_build_tart(macos_version, bazel_cache_host, configuration, build_inpu
         guest_build_sh += '--codesigningInformationPath=$HOME/telegram-build-input \\'
         guest_build_sh += '--outputBuildArtifactsPath=/Users/Shared/telegram-ios/build/artifacts \\'
 
-        guest_build_file_path = tempfile.mktemp()
-        with open(guest_build_file_path, 'w+') as file:
+        guest_build_fd, guest_build_file_path = tempfile.mkstemp()
+        with os.fdopen(guest_build_fd, 'w+') as file:
             file.write(guest_build_sh)
         session.upload_file(local_path=guest_build_file_path, remote_path='guest-build-telegram.sh')
         os.unlink(guest_build_file_path)

submodules/TelegramUI/Resources/Readability/Readability.js

@@ -463,7 +463,7 @@ Readability.prototype = {
       if (href) {
         // Remove links with javascript: URIs, since
         // they won't work after scripts have been removed from the page.
-        if (href.indexOf("javascript:") === 0) {
+        if (/^javascript:/i.test(href.replace(/[\u0000-\u0020]/g, ""))) {
           // if the link only contains simple text content, it can be converted to a text node
           if (
             link.childNodes.length === 1 &&