pro/im_webapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix a security issue with absolute URL appearing as relative du to backslashes

Browse Source
This commit is contained in:
or-else
2023-12-15 14:25:44 -08:00
parent 1155888ced
commit f5714b3b69
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/utils.js
+8 -2
View File
@@ -108,9 +108,12 @@ export function asEmail(val) {
// example.html - ok // example.html - ok
// https:example.com - not ok. // https:example.com - not ok.
// http:/example.com - not ok. // http:/example.com - not ok.
// //example.com or \\example.com - not ok.
// ' ↲ https://example.com' - not ok. (↲ means carriage return) // ' ↲ https://example.com' - not ok. (↲ means carriage return)
export function isUrlRelative(url) { export function isUrlRelative(url) {
return url && !/^\s*([a-z][a-z0-9+.-]*:|\/\/)/im.test(url); // Replacing backslashes with forward slashes to mimic JS URL parser then testing for
// 'scheme:' and '//' with optional space at the start.
return url && !/^\s*([a-z][a-z0-9+.-]*:|\/\/)/im.test(url.replace(/\\/g, '/'));
} }
// Ensure URL does not present an XSS risk. Optional allowedSchemes may contain an array of // Ensure URL does not present an XSS risk. Optional allowedSchemes may contain an array of
@@ -121,7 +124,10 @@ export function sanitizeUrl(url, allowedSchemes) {
} }
// Strip control characters and whitespace. They are not valid URL characters anyway. // Strip control characters and whitespace. They are not valid URL characters anyway.
url = url.replace(/[^\x20-\x7E]/gmi, '').trim(); url = url.replace(/[^\x21-\x7E]/gmi, '').trim();
// Replace backslashes with forward slashes. They will be replaced in the URL parser anyway.
url = url.replace(/\\/g, '/');
// Relative URLs are safe. // Relative URLs are safe.
// Relative URL does not start with ':', abcd123: or '//'. // Relative URL does not start with ':', abcd123: or '//'.