fix: Ensure url is valid before opening to prevent XSS

Doist · Jul 4, 2024 · 3c7c1ad · 3c7c1ad
1 parent 20b6cae
commit 3c7c1ad
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 3 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/ui-extensions-react/package.json b/packages/ui-extensions-react/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@doist/ui-extensions-react",
-    "version": "12.0.0",
+    "version": "12.0.1",
     "author": "Doist",
     "license": "MIT",
     "main": "dist/index.js",

diff --git a/packages/ui-extensions-react/src/components/adaptive-card/AdaptiveCardRenderer.tsx b/packages/ui-extensions-react/src/components/adaptive-card/AdaptiveCardRenderer.tsx
@@ -61,6 +61,28 @@ export function registerMarkdownParser(markdownParser: (text: string) => string)
     }
 }
 
+/**
+ * Protects against XSS attacks by validating the URL.
+ * @param url 
+ * @returns 
+ */
+function isValidUrl(url: string): boolean {
+    try {
+        // Parse the URL using the URL constructor
+        let parsedUrl = new URL(url);
+
+        // Check for allowed protocols
+        if (parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:") {
+            return true;
+        } else {
+            return false;
+        }
+    } catch (e) {
+        // If URL constructor throws an error, it's an invalid URL
+        return false;
+    }
+}
+
 /**
  * To support markdown, register a markdown parser via `registerMarkdownParser`
  * @see registerMarkdownParser
@@ -97,7 +119,7 @@ export function AdaptiveCardRenderer({
         try {
             const inputs = adaptiveCard.getAllInputs()
             const inputsObject = getInputObject(inputs)
-            if (action instanceof OpenUrlAction && action.url) {
+            if (action instanceof OpenUrlAction && action.url && isValidUrl(action.url)) {
                 window.open(action.url, '_blank')
             } else if (action instanceof ClipboardAction && action.text) {
                 clipboardHandler(action.text)