mythic-insight/calcom
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 5

Adds console url to redirection whitelist

Browse source
This commit is contained in:
zomars 2022-05-05 16:29:17 -06:00
parent 70455f56a2
commit 0b82b85166
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
packages/lib/constants.ts
View file

@ -2,6 +2,9 @@ export const WEBAPP_URL = process.env.NEXT_PUBLIC_WEBAPP_URL || `https://${proce
/** @deprecated use `WEBAPP_URL` */ /** @deprecated use `WEBAPP_URL` */
export const BASE_URL = WEBAPP_URL; export const BASE_URL = WEBAPP_URL;
export const WEBSITE_URL = process.env.NEXT_PUBLIC_WEBSITE_URL || "https://cal.com"; export const WEBSITE_URL = process.env.NEXT_PUBLIC_WEBSITE_URL || "https://cal.com";
export const CONSOLE_URL = WEBAPP_URL.startsWith("http://localhost")
? "http://localhost:3004"
: `https://console.cal.${process.env.VERCEL_ENV === "production" ? "com" : "dev"}`;
export const IS_PRODUCTION = process.env.NODE_ENV === "production"; export const IS_PRODUCTION = process.env.NODE_ENV === "production";
export const TRIAL_LIMIT_DAYS = 14; export const TRIAL_LIMIT_DAYS = 14;
export const HOSTED_CAL_FEATURES = process.env.HOSTED_CAL_FEATURES || BASE_URL === "https://app.cal.com"; export const HOSTED_CAL_FEATURES = process.env.HOSTED_CAL_FEATURES || BASE_URL === "https://app.cal.com";

7
packages/lib/getSafeRedirectUrl.ts
View file

@ -1,14 +1,13 @@
import { WEBAPP_URL, WEBSITE_URL } from "@calcom/lib/constants"; import { CONSOLE_URL, WEBAPP_URL, WEBSITE_URL } from "@calcom/lib/constants";
// It ensures that redirection URL safe where it is accepted through a query params or other means where user can change it. // It ensures that redirection URL safe where it is accepted through a query params or other means where user can change it.
export const getSafeRedirectUrl = (url: string | undefined) => { export const getSafeRedirectUrl = (url: string = "") => {
url = url || "";
if (url.search(/^https?:\/\//) === -1) { if (url.search(/^https?:\/\//) === -1) {
throw new Error("Pass an absolute URL"); throw new Error("Pass an absolute URL");
} }
// Avoid open redirection security vulnerability // Avoid open redirection security vulnerability
if (!url.startsWith(WEBAPP_URL) && !url.startsWith(WEBSITE_URL)) { if (![CONSOLE_URL, WEBAPP_URL, WEBSITE_URL].some((u) => url.startsWith(u))) {
url = `${WEBAPP_URL}/`; url = `${WEBAPP_URL}/`;
} }