diff options
| author | syuilo <Syuilotan@yahoo.co.jp> | 2023-02-09 18:01:12 +0900 |
|---|---|---|
| committer | syuilo <Syuilotan@yahoo.co.jp> | 2023-02-09 18:01:12 +0900 |
| commit | 70fe23a3ce8a37b9a848c2da80c0a84cf8f559bf (patch) | |
| tree | 5941a3729285745d0365d477461d321a53c6baf7 | |
| parent | Merge branch 'develop' of https://github.com/misskey-dev/misskey into develop (diff) | |
| download | misskey-70fe23a3ce8a37b9a848c2da80c0a84cf8f559bf.tar.gz misskey-70fe23a3ce8a37b9a848c2da80c0a84cf8f559bf.tar.bz2 misskey-70fe23a3ce8a37b9a848c2da80c0a84cf8f559bf.zip | |
fix(client): validate url to improve security
| -rw-r--r-- | packages/frontend/src/pages/auth.vue | 2 | ||||
| -rw-r--r-- | packages/frontend/src/pages/miauth.vue | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/packages/frontend/src/pages/auth.vue b/packages/frontend/src/pages/auth.vue index bb55881a22..b7727ca30d 100644 --- a/packages/frontend/src/pages/auth.vue +++ b/packages/frontend/src/pages/auth.vue @@ -77,6 +77,8 @@ export default defineComponent({ accepted() { this.state = 'accepted'; if (this.session.app.callbackUrl) { + const url = new URL(this.session.app.callbackUrl); + if (['javascript:', 'file:', 'data:', 'mailto:', 'tel:'].includes(url.protocol)) throw new Error('invalid url'); location.href = `${this.session.app.callbackUrl}?token=${this.session.token}`; } }, onLogin(res) { diff --git a/packages/frontend/src/pages/miauth.vue b/packages/frontend/src/pages/miauth.vue index 3debaeeb61..9a4019e5b1 100644 --- a/packages/frontend/src/pages/miauth.vue +++ b/packages/frontend/src/pages/miauth.vue @@ -70,7 +70,7 @@ async function accept(): Promise<void> { state = 'accepted'; if (props.callback) { const cbUrl = new URL(props.callback); - if (!['http:', 'https:'].includes(cbUrl.protocol)) throw new Error('invalid url'); + if (['javascript:', 'file:', 'data:', 'mailto:', 'tel:'].includes(cbUrl.protocol)) throw new Error('invalid url'); cbUrl.searchParams.set('session', props.session); location.href = cbUrl.href; } |