Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links

An authenticated attacker creates a bookmark and sets the Description field to a Markdown reference-style link, e.g. `[Click Me for XSS][1]` followed by a reference definition `[1]: javascript:alert('XSS_MARKDOWN')`. The `filterProtocols` method does not inspect reference definitions, so the `javascript:` URI passes through unsanitized. When the Markdown parser renders the description to HTML, it produces an `<a>` tag with a malicious `href` attribute. Any user who clicks the rendered link on the homepage triggers the attacker's JavaScript payload [ref_id=1].

The vulnerability is in the `filterProtocols` method within `BookmarkMarkdownFormatter.php`. This method attempts to sanitize Markdown links by filtering dangerous protocols (such as `javascript:`) using the regex `(#]\\((.*?)\\)#is)`, which only detects inline Markdown links. It fails to inspect reference-style links because those are resolved by the Markdown parser after preprocessing, so the sanitization never sees the actual URL used in the reference definition [ref_id=1].

The advisory states the issue is fixed in version 0.16.2 [ref_id=1]. The patch is not shown in the bundle, but the fix would need to extend protocol filtering to cover reference-style link definitions, not just inline Markdown links. By sanitizing the URL in the reference definition before the Markdown parser resolves it, the `javascript:` URI would be blocked and the resulting `<a>` tag would have a safe `href` attribute.