fix: reject control characters in manifest URLs

packages/contract/src/ascii.ts

@@ -0,0 +1,9 @@
+export function containsAsciiControl(value: string): boolean {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)) {
+      return true;
+    }
+  }
+  return false;
+}

packages/contract/src/parse.ts

@@ -14,6 +14,7 @@ import {
   type ToolboxRequirements,
   type ToolboxSource,
 } from "./types.js";
+import { containsAsciiControl } from "./ascii.js";
 
 type UnknownRecord = Record<string, unknown>;
 
@@ -108,6 +109,10 @@ function referenceAt(
 ): string | undefined {
   const value = stringAt(object, key, path, issues, { optional });
   if (value === undefined) return undefined;
+  if (containsAsciiControl(value)) {
+    issues.push(`${path}.${key} must not contain ASCII control characters`);
+    return undefined;
+  }
   if (value.includes("\\")) {
     issues.push(`${path}.${key} must use URL path separators`);
     return undefined;

packages/contract/src/urls.ts

@@ -6,6 +6,7 @@ import {
   type ResolvedToolboxPrivacy,
   type ToolboxAppManifest,
 } from "./types.js";
+import { containsAsciiControl } from "./ascii.js";
 
 const WEB_PROTOCOLS = new Set(["http:", "https:"]);
 
@@ -13,6 +14,15 @@ export function resolveWebUrl(
   reference: string | URL,
   base?: string | URL,
 ): URL {
+  if (
+    (typeof reference === "string" && containsAsciiControl(reference)) ||
+    (typeof base === "string" && containsAsciiControl(base))
+  ) {
+    throw new ToolboxError(
+      "invalid-url",
+      "URL strings must not contain ASCII control characters",
+    );
+  }
   let url: URL;
   try {
     url = base === undefined ? new URL(reference) : new URL(reference, base);