From 502a3fd4e8416e1033399fea2d3a731dc0b47893 Mon Sep 17 00:00:00 2001 From: Maurice Date: Sun, 23 Aug 2026 10:53:10 +0200 Subject: [PATCH] fix(shared): express the URL scheme check without a control-character regex Same behaviour, and the root lint job stops failing on no-control-regex. The stripping is the point and has to stay: browsers drop everything at or below U+0020 before they resolve a scheme, so a tab spliced into 'javascript:' is still a javascript: URL to them. --- shared/src/reservation/reservation.schema.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/shared/src/reservation/reservation.schema.ts b/shared/src/reservation/reservation.schema.ts index 89c9b6131..ab5e66fae 100644 --- a/shared/src/reservation/reservation.schema.ts +++ b/shared/src/reservation/reservation.schema.ts @@ -212,8 +212,9 @@ export type Accommodation = z.infer; */ export const reservationUrlSchema = z.string().refine( // Browsers strip control characters and whitespace before they resolve the - // scheme, so a tab spliced into 'javascript:' still runs. - v => !/^(javascript|data|vbscript):/i.test(v.replace(/[\u0000-\u0020]/g, '')), + // scheme, so a tab spliced into 'javascript:' still runs. Everything at + // or below U+0020 goes, which is the same set a browser drops. + v => !/^(javascript|data|vbscript):/i.test(Array.from(v).filter(c => c > ' ').join('')), { message: 'must not be a javascript:, data: or vbscript: URL' }, );