fix: additional fix for possible xss injection

opengovsg / starter-kit

A technical kit to quickly build new products

https://start.open.gov.sg

MIT License

36 stars 6 forks source link

fix: additional fix for possible xss injection #279

Closed karrui closed 6 months ago

karrui commented 6 months ago

The previous fix in #274 was not enough and there are some possible strings that could still bypass the isRelativeUrl check. This PR adds in a new environment variable NEXT_PUBLIC_APP_URL (only required-ish on non-vercel deployments) to correctly ascertain that the URL to check is a relative URL, by comparing origins and ensuring both origins match.

vercel[bot] commented 6 months ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
starter-kit	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Mar 6, 2024 9:46am

karrui commented 6 months ago

checked all test urls on preview, mitigated and defaults to /home if improper.