https://gitlab.synchro.net/main/sbbs/-/commit/791eb3ad3cb2ff6d324797d1
Modified Files:
webv4/lib/pages.js webv4/root/index.xjs
Log Message:
webv4: don't throw on an unresolvable .link page

A crawler request for /index.xjs?page=US 99/050-cahighways.link logged:

!JavaScript lib/pages.js line 108: Error: Invalid page US
99/050-cahighways.link,,,s:\sbbs\webv4\mods\pages\

and returned that text to the client in place of a page.

index.xjs sends any page name ending in .link to getExternalLink(),
which threw when getPagePath() couldn't resolve it, aborting the whole
render. Every other unusable ?page= value quietly falls back to the
home page. Since the web server writes an uncaught script error into
the response body as text/html, and the message interpolated the raw
?page= value, this also reflected attacker-supplied markup back to the
browser and disclosed the server's absolute paths.

Return null rather than throwing (also on a failed open), redirect only
when there's a target, and otherwise fall back to the home page. Match
.link case-insensitively so a .LINK request takes the redirect branch
instead of rendering an empty body.

Tighten what counts as a usable .link while here: parse only the first
line, as _getPageList() does, so a comma on a later line can't splice a Location header together, and reject an empty target, which previously
produced a redirect to nowhere.

The throws date to 2131c3f950 (2021-02-19); this is the same class of
bug as 0d40b6dee4 (2026-07-27), one call site further along.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net