fix: Add Url validation in Anchor and Page#open#24371
Conversation
Add method to validate allowed URLs based on scheme and control characters.
Add URL validation to prevent opening disallowed URLs.
| public class UrlUtil { | ||
|
|
||
| private static final Set<String> ALLOWED_SCHEMES = Set.of( | ||
| "http", "https", "mailto", "ftp"); |
There was a problem hiding this comment.
This is going to create really weird and hard to spot bugs for user that e.g. rely on custom schemes to redirect their users to other apps / services and so on :/
There was a problem hiding this comment.
Yes, looks like the wrong approach with an "allow" list instead of a "disallow" list
There was a problem hiding this comment.
Could be. I could just disallow "javascript".
There was a problem hiding this comment.
Yes, and if so, there should be a way to opt-out from the check also, to avoid breaking apps where you actually use javascript: but not combine it with user supplied strings
There was a problem hiding this comment.
Example; we use javascript:scrollFocus inside an anchor to create accessible skip links :(
(scrollFocus is a method we have written)
There was a problem hiding this comment.
Is that consistent with how other similar cases are handled?
There was a problem hiding this comment.
I added override API to PR
Change return value for empty input from false to true.
github-project-automation
Bot
moved this to 🔎Iteration reviews
in Vaadin Flow | Hilla | Kits ongoing work
Updated the disallowed URL schemes to include 'data' and added methods to set custom disallowed schemes and check if a URL is allowed.
|
4 participants
No description provided.