fix: enforce protocol in shortcut urls

owncloud · Jun 20, 2024 · 2d05b92 · 2d05b92
1 parent b28043c
commit 2d05b92
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 5 deletions.
diff --git a/changelog/unreleased/bugfix-enforce-shortcut-url-protocol b/changelog/unreleased/bugfix-enforce-shortcut-url-protocol
@@ -0,0 +1,6 @@
+Bugfix: Enforce shortcut URL protocol
+
+We've fixed a bug where the protocol in shortcut URLs was not enforced. Now, the shortcut URL always starts `https://` if no protocol is provided by the user.
+
+https://github.com/owncloud/web/issues/11063
+https://github.com/owncloud/web/pull/11076
diff --git a/packages/web-pkg/src/components/CreateShortcutModal.vue b/packages/web-pkg/src/components/CreateShortcutModal.vue
@@ -154,14 +154,16 @@ export default defineComponent({
     const isDropOpen = ref(false)
     let markInstance = null
 
-    const dropItemUrl = computed(() => {
-      let url = unref(inputUrl).trim()
-
+    const getInputUrlWithProtocol = (input: string) => {
+      let url = input.trim()
       if (isMaybeUrl(url)) {
         return url
       }
-
       return `https://${url}`
+    }
+
+    const dropItemUrl = computed(() => {
+      return getInputUrlWithProtocol(unref(inputUrl))
     })
 
     const confirmButtonDisabled = computed(
@@ -327,7 +329,9 @@ export default defineComponent({
     const onConfirm = async () => {
       try {
         // Omit possible xss code
-        const sanitizedUrl = DOMPurify.sanitize(unref(inputUrl), { USE_PROFILES: { html: true } })
+        const sanitizedUrl = DOMPurify.sanitize(getInputUrlWithProtocol(unref(inputUrl)), {
+          USE_PROFILES: { html: true }
+        })
 
         const content = `[InternetShortcut]\nURL=${sanitizedUrl}`
         const path = urlJoin(unref(currentFolder).path, `${unref(inputFilename)}.url`)