worldcoin / developer-portal

The Worldcoin Developer Portal provides tools to interact with the Worldcoin SDK. Easiest way to get started with World ID.
https://developer.worldcoin.org
MIT License
66 stars 35 forks source link

Replace XSS check with broader URL check #709

Closed RedYetiDev closed 5 months ago

RedYetiDev commented 5 months ago

[!NOTE] While this may seem like a security patch, backend validation checks in the GraphQL already sanitize redirect URLs.

This PR replaces the case-sensitive javascript: check with a broader check which also verifies that the URL provided is a valid URL.

OLD

jAvAsCrIpT:alert(/xss/) -> true (valid) javascript:alert(/xss/) -> false (invalid) https://www.example.com/ -> true (valid) htp:example -> true (valid)

NEW

jAvAsCrIpT:alert(/xss/) -> false (invalid) javascript:alert(/xss/) -> false (invalid) https://www.example.com/ -> true (valid) htp:example -> false (invalid)

RedYetiDev commented 5 months ago

Closing in favor of #707