k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-19 05:26:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(shared): express the URL scheme check without a control-character regex

Browse Source 
Same behaviour, and the root lint job stops failing on no-control-regex. The
stripping is the point and has to stay: browsers drop everything at or below
U+0020 before they resolve a scheme, so a tab spliced into 'javascript:' is
still a javascript: URL to them.
This commit is contained in:
Maurice
2026-08-23 10:53:10 +02:00
committed by Maurice
parent 38f3cb3101
commit 502a3fd4e8
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shared/src/reservation/reservation.schema.ts
+3 -2
View File
@@ -212,8 +212,9 @@ export type Accommodation = z.infer<typeof accommodationSchema>;
*/
export const reservationUrlSchema = z.string().refine(
// Browsers strip control characters and whitespace before they resolve the
// scheme, so a tab spliced into 'javascript:' still runs.
v => !/^(javascript|data|vbscript):/i.test(v.replace(/[\u0000-\u0020]/g, '')),
// scheme, so a tab spliced into 'javascript:' still runs. Everything at
// or below U+0020 goes, which is the same set a browser drops.
v => !/^(javascript|data|vbscript):/i.test(Array.from(v).filter(c => c > ' ').join('')),
{ message: 'must not be a javascript:, data: or vbscript: URL' },
);