feat: validate script import payloads

Author: SysAdminDoc

CHANGELOG.md

@@ -17,6 +17,7 @@ All notable changes to ScriptHunt will be documented in this file.
 - GitHub token settings in Diagnostics with save/remove controls, rate-limit checks, authenticated search headers, and redacted diagnostics.
 - Manager-aware security scan findings for broad `@match`/`@include`, enumerated `@connect`, pinned vs floating `@require`, and update/download URL host drift.
 - Metadata parsing now preserves localized `@name`/`@description`, `@exclude-match`, compatibility directives, and repeated keys without overwriting values.
+- Installed-script exports with `scripthunt-installed` schema v1 plus stricter import validation that skips bad rows without aborting valid rows.
 
 ### Fixed
 - Metadata scan cache keys now stay stable when a script declares a different `@updateURL`.

README.md

@@ -56,7 +56,7 @@ npm run qa
 | **Permission Risk Pills** | Color-coded pills showing @grant danger levels (safe/warn/danger) per script |
 | **Script Comparison** | Select up to 3 scripts for side-by-side comparison with best-value highlighting |
 | **Favorites** | Save scripts to localStorage with versioned JSON export/import and undo on removal |
-| **Installed Import** | Import installed-script lists locally to mark installed scripts and available updates in search results |
+| **Installed Import/Export** | Import and export installed-script lists locally to mark installed scripts and available updates in search results |
 | **Advanced Query Syntax** | `site:`, `author:`, `updated:`, `grant:` operators with domain-aware by-site.json search and metadata-backed grant filtering |
 | **Advanced Filters** | Visible controls for source, license, installs, updated date, catalog language, @grant, risk, and applies-to domain |
 | **Applies-To Evidence** | Site-filtered results show source site matches alongside parsed `@match`, `@include`, and `@exclude` metadata evidence |
@@ -231,7 +231,7 @@ Yes. Deploy the included Cloudflare Worker template (free tier: 100K requests/da
 - **CORS Proxy** — allorigins.win → codetabs → everyorigin fallback chain with exponential backoff
 - **PWA** — manifest.json + service worker for installability, offline shell loading, and local recent-search recovery
 - **localStorage + IndexedDB** - preferences, favorites, source toggles, theme, recent search results, and scan cache persist locally; no tracking, no cookies, no server-side state
-- **Versioned JSON payloads** - favorites exports use `scripthunt-favorites` schema v1; installed imports accept `scripthunt-installed` schema v1, manager-style `scripts` arrays, and legacy arrays
+- **Versioned JSON payloads** - favorites and installed-list exports use schema v1; imports validate URLs, report skipped invalid rows, and still accept manager-style `scripts` arrays plus legacy arrays
 - **Local QA** - npm run qa runs npm audit, Worker tests, and Playwright smoke/adapter tests against the repo-local static server
 
 ---

ROADMAP.md

@@ -27,13 +27,6 @@
 ## Research-Driven Additions
 
 ### P2
-- [ ] P2 - Version and validate all import/export payloads
-  Why: Favorites import currently accepts arbitrary arrays and can persist malformed records or inconsistent URLs.
-  Evidence: `index.html:637`, `index.html:647`, `index.html:2237`, quoid/userscripts installURL issue, ScriptCat migration/backup issues.
-  Touches: `index.html` favorites export/import, installed-script import model, README import/export docs, Playwright import tests.
-  Acceptance: favorites and installed-script exports include schema/version fields, imports validate and normalize records before persistence, invalid rows are reported without aborting valid rows, and legacy array exports still import through a migration path.
-  Complexity: M
-
 - [ ] P2 - Add PWA update and cache recovery controls
   Why: The service worker uses cache-first shell behavior without telling users when a new shell is available or when cache recovery was used.
   Evidence: `sw.js`, README PWA feature, MDN StorageManager/offline guidance.

index.html

@@ -382,6 +382,7 @@
             <button class="tool-btn" id="btnBookmarklet" title="Bookmarklet tool" popovertarget="bookmarkletSection">Bookmarklet</button>
             <button class="tool-btn" id="btnFavorites" title="View favorites">Favorites</button>
             <button class="tool-btn" id="btnImportInstalled" title="Import installed scripts">Installed</button>
+            <button class="tool-btn" id="btnExportInstalled" title="Export installed scripts">Export Installed</button>
             <button class="tool-btn" id="btnDiagnostics" title="Source diagnostics" popovertarget="diagnosticsSection">Diagnostics</button>
             <button class="tool-btn" id="btnExportFavs" title="Export favorites" style="display:none">Export</button>
             <button class="tool-btn" id="btnImportFavs" title="Import favorites" style="display:none">Import</button>
@@ -835,6 +836,13 @@ <h3>Search userscripts everywhere</h3>
     function isFav(id) { return getFavs().some(function(f) { return f.id === id; }); }
 
     function cleanUrl(u) { return (u || '').trim(); }
+    function validImportUrl(u) {
+        if (!u) return true;
+        try {
+            var url = new URL(String(u).trim());
+            return url.protocol === 'http:' || url.protocol === 'https:';
+        } catch(e) { return false; }
+    }
     function normalizeScriptUrls(item) {
         item.installUrl = cleanUrl(item.installUrl || item.downloadUrl || item.updateUrl || '');
         item.downloadUrl = cleanUrl(item.downloadUrl || item.installUrl || '');
@@ -863,6 +871,8 @@ <h3>Search userscripts everywhere</h3>
 
     function normalizeImportedScript(item) {
         if (!item || typeof item !== 'object') return null;
+        var rawUrls = [item.url, item.homepageURL, item.homepage, item.installUrl, item.install_url, item.downloadURL, item.downloadUrl, item.download_url, item.updateUrl, item.updateURL, item.update_url];
+        if (rawUrls.some(function(u) { return u && !validImportUrl(u); })) return null;
         var out = exportScriptRecord({
             id: item.id || item.uuid || '',
             name: item.name || item.title || '',
@@ -944,14 +954,25 @@ <h3>Search userscripts everywhere</h3>
         };
     }
 
+    function buildInstalledExport() {
+        return {
+            schema: 'scripthunt-installed',
+            version: 1,
+            exportedAt: new Date().toISOString(),
+            installed: getInstalledScripts().map(normalizeImportedScript).filter(Boolean),
+        };
+    }
+
     function parseScriptImportPayload(payload, preferredType) {
         var type = preferredType || 'favorites';
         var rows = [];
         if (Array.isArray(payload)) {
             rows = payload;
         } else if (payload && typeof payload === 'object') {
+            if (payload.schema && payload.version !== 1) throw new Error('Unsupported import version');
             if (payload.schema === 'scripthunt-installed') { type = 'installed'; rows = payload.installed || payload.scripts || []; }
             else if (payload.schema === 'scripthunt-favorites') { type = 'favorites'; rows = payload.favorites || []; }
+            else if (payload.schema) throw new Error('Unsupported import schema');
             else if (Array.isArray(payload.installed) || Array.isArray(payload.scripts)) { type = 'installed'; rows = payload.installed || payload.scripts; }
             else if (Array.isArray(payload.favorites)) { type = 'favorites'; rows = payload.favorites; }
         }
@@ -2937,20 +2958,29 @@ <h3>Search userscripts everywhere</h3>
     });
 
     // Favorites button
-    var btnExport = document.getElementById('btnExportFavs'), btnImport = document.getElementById('btnImportFavs'), btnImportInstalled = document.getElementById('btnImportInstalled');
+    var btnExport = document.getElementById('btnExportFavs'), btnImport = document.getElementById('btnImportFavs'), btnImportInstalled = document.getElementById('btnImportInstalled'), btnExportInstalled = document.getElementById('btnExportInstalled');
     document.getElementById('btnFavorites').addEventListener('click', function() {
         this.classList.toggle('active');
         var active = this.classList.contains('active');
         btnExport.style.display = active ? '' : 'none'; btnImport.style.display = active ? '' : 'none';
         if (active) { showFavorites(); } else { if (state.rawQuery) { state.showFavs = false; sortAndRender(); } else { clearBtn.click(); } }
     });
 
+    function downloadJson(payload, filename) {
+        var blob = new Blob([JSON.stringify(payload, null, 2)], { type: 'application/json' });
+        var a = document.createElement('a'); a.href = URL.createObjectURL(blob); a.download = filename; a.click();
+        URL.revokeObjectURL(a.href);
+    }
+
     // Export favorites
     btnExport.addEventListener('click', function() {
         var favs = getFavs(); if (!favs.length) { showToast('No favorites to export', 'error', 2000); return; }
-        var blob = new Blob([JSON.stringify(buildFavoritesExport(), null, 2)], { type: 'application/json' });
-        var a = document.createElement('a'); a.href = URL.createObjectURL(blob); a.download = 'scripthunt-favorites.json'; a.click();
-        URL.revokeObjectURL(a.href); showToast('Exported ' + favs.length + ' favorites', 'info', 2000);
+        downloadJson(buildFavoritesExport(), 'scripthunt-favorites.json'); showToast('Exported ' + favs.length + ' favorites', 'info', 2000);
+    });
+
+    btnExportInstalled.addEventListener('click', function() {
+        var installed = getInstalledScripts(); if (!installed.length) { showToast('No installed scripts to export', 'error', 2000); return; }
+        downloadJson(buildInstalledExport(), 'scripthunt-installed.json'); showToast('Exported ' + installed.length + ' installed scripts', 'info', 2000);
     });
 
     // Import favorites

tests/smoke.spec.js

@@ -280,6 +280,46 @@ test('installed import marks matching scripts and update state', async ({ page }
   const card = page.locator('.result-card').filter({ hasText: 'YouTube Enhancer' });
   await expect(card).toContainText('Update available');
   await expect(card.locator('.card-btn-install')).toContainText('Update');
+
+  const downloadPromise = page.waitForEvent('download');
+  await page.click('#btnExportInstalled');
+  const download = await downloadPromise;
+  const text = await fs.readFile(await download.path(), 'utf8');
+  const payload = JSON.parse(text);
+  expect(payload.schema).toBe('scripthunt-installed');
+  expect(payload.version).toBe(1);
+  expect(payload.installed[0]).toMatchObject({
+    name: 'YouTube Enhancer',
+    version: '0.9.0',
+    installUrl: 'https://greasyfork.org/scripts/101-youtube-enhancer/code/YouTube%20Enhancer.user.js',
+  });
+});
+
+test('script imports skip invalid rows without aborting valid rows', async ({ page }) => {
+  await page.goto('/');
+  const chooserPromise = page.waitForEvent('filechooser');
+  await page.click('#btnImportInstalled');
+  const chooser = await chooserPromise;
+  await chooser.setFiles({
+    name: 'installed-mixed.json',
+    mimeType: 'application/json',
+    buffer: Buffer.from(JSON.stringify({
+      schema: 'scripthunt-installed',
+      version: 1,
+      installed: [
+        { name: 'YouTube Enhancer', version: '1.0.0', installUrl: 'https://greasyfork.org/scripts/101-youtube-enhancer/code/YouTube%20Enhancer.user.js' },
+        { name: 'Bad URL', installUrl: 'javascript:alert(1)' },
+        { description: 'missing identity' },
+      ],
+    })),
+  });
+
+  await expect(page.locator('.toast').last()).toContainText('Imported 1 installed scripts (2 invalid skipped)');
+  const stored = await page.evaluate(() => JSON.parse(localStorage.getItem('sh_installed_scripts')));
+  expect(stored.schema).toBe('scripthunt-installed');
+  expect(stored.version).toBe(1);
+  expect(stored.installed).toHaveLength(1);
+  expect(JSON.stringify(stored)).not.toContain('javascript:');
 });
 
 test('result icon buttons have accessible names', async ({ page }) => {