oscar-surf/misskey
oscar-surf/misskey
0
0
Fork 0
Code Issues Activity

fix(client): validate urls to improve security

Browse source
This commit is contained in:
syuilo 2023-02-04 09:10:01 +09:00
parent 572000f868
commit 788ae2f6ca
4 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
packages/frontend/src/pages/miauth.vue
View file

@ -70,6 +70,7 @@ async function accept(): Promise<void> {
state = 'accepted';
if (props.callback) {
const cbUrl = new URL(props.callback);
if (!['http:', 'https:'].includes(cbUrl.protocol)) throw new Error('invalid url');
cbUrl.searchParams.set('session', props.session);
location.href = cbUrl.href;
}