fix(security): restrict link protocols to http and https (#1888)

2025-01-10 14:45:30 +01:00
parent 80c02ef9f2
commit a12dd10269
5 changed files with 41 additions and 4 deletions
--- a/packages/validation/src/app.ts
+++ b/packages/validation/src/app.ts
@@ -4,7 +4,11 @@ const manageAppSchema = z.object({
  name: z.string().min(1).max(64),
  description: z.string().max(512).nullable(),
  iconUrl: z.string().min(1),
-  href: z.string().nullable(),
+  href: z
+    .string()
+    .url()
+    .regex(/^https?:\/\//) // Only allow http and https for security reasons (javascript: is not allowed)
+    .nullable(),
 });

 const editAppSchema = manageAppSchema.and(z.object({ id: z.string() }));