Keep protocol-relative URLs intact in Snowboard's Url utility

[wakqasahmed]

Url.to() and Url.asset() only treated a URL as absolute if it had an explicit scheme, so something like //maps.googleapis.com/maps/api/js had its leading slashes stripped and got resolved as <site>/maps.googleapis.com/maps/api/js. For assets injected over AJAX through X_WINTER_ASSETS, that 404 makes AssetLoader.loadScript() reject and the handler never finishes.

As suggested on the issue, this just makes the scheme optional in the absolute-URL regex, in both methods. Relative paths, including ones with a single leading slash, still resolve against the base/asset URL as before.

I added a Jest test at modules/system/tests/js/cases/snowboard/utilities/Url.test.js that imports the Url utility from source, so it doesn't depend on the compiled bundle. It covers relative, absolute and protocol-relative URLs for both methods. The protocol-relative case fails without the change, and the full module-system JS suite passes with it (48 tests). I've left the compiled Snowboard bundles alone, following how other recent Snowboard fixes were submitted. Happy to include a rebuild if you'd prefer.

Fixes #1538

Summary by CodeRabbit

• Bug Fixes
  • Protocol-relative URLs are now preserved when used with URL and asset helpers.
• Tests
  • Added coverage for empty, relative, absolute, and protocol-relative URL handling.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 47eb33df-c079-4553-b696-e8ca91c13110

📥 Commits

Reviewing files that changed from the base of the PR and between 4ab9e5a and a0ee322.

📒 Files selected for processing (2)

• modules/system/assets/js/snowboard/utilities/Url.js
• modules/system/tests/js/cases/snowboard/utilities/Url.test.js

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

Url.to and Url.asset now return protocol-relative URLs unchanged, alongside URLs with an explicit scheme. Tests cover empty, relative, leading-slash, absolute, and protocol-relative inputs.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Fixed issue severity: <fixed_issue_severity>Medium</fixed_issue_severity>

Merge Risk: ⚪ Minimal · up to a0ee3

Protocol-relative URLs are preserved in both URL methods, with corresponding tests. No actionable merge risk remains beyond normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to a0ee3

The change enables intended third-party asset URLs in AJAX responses. Fully qualified external URLs already worked, and no attacker-controlled asset source was established. The remaining risk depends on who can supply asset URLs and which origins browsers are permitted to load.

Retained concerns

• Low · security · inferred: Protocol-relative URLs in AJAX asset manifests can now select the script host without client-side origin validation. Whether that newly working path is appropriately constrained depends on the manifest producer and browser script policy; attacker control or a policy bypass has not been established. Explicit HTTP(S) asset URLs already had equivalent host-selection capability.

Security review details

Security Blast Radius

• inferred — The demonstrated effect is browser resource loading for pages processing an AJAX asset manifest, including execution of a successfully loaded script in that page. Evidence does not establish an independently attacker-controllable manifest or wider tenant exposure.

Trust Boundaries and Controls

• observed — Backend AJAX asset lists can originate from registered server assets, while a handler-returned array can override response fields. Non-public backend actions require authentication and applicable permissions. These facts do not establish the trust of every AJAX asset producer or a browser origin policy.

Hardening Proposals

• proposed — Confirm which AJAX handlers may supply asset manifests and the deployed script, style, and image origin policies before relying on protocol-relative third-party hosts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving protocol-relative URLs in Snowboard's Url utility.
Linked Issues check	✅ Passed	Issue [#1538] requires Url.to() and Url.asset() to preserve protocol-relative URLs. The reviewed Url.js makes the scheme optional in the URL regex, so //cdn.example.org/page and similar URLs r…
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to the two URL recognition checks and focused Jest coverage in Url.test.js. These changes directly implement and verify issue [#1538]. No unrelated production behavi…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}