validateIri to Reject "http://" URL (#1158)

CycloneDX · Jun 10, 2024 · 4905b81 · 4905b81
1 parent 43c5bbf
commit 4905b81
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 7 deletions.
diff --git a/types/utils.d.ts.map b/types/utils.d.ts.map
diff --git a/utils.js b/utils.js
@@ -10674,14 +10674,26 @@ export function parseMakeDFile(dfile) {
  *
  */
 export function isValidIriReference(iri) {
-  const result = validateIri(iri, IriValidationStrategy.Strict);
+  let iriIsValid = true;
+  const validateIriResult = validateIri(iri, IriValidationStrategy.Strict);
 
-  if (result instanceof Error) {
-    if (DEBUG_MODE) {
-      console.log(`IRI failed validation ${iri}`);
+  if (validateIriResult instanceof Error) {
+    iriIsValid = false;
+  } else if (iri.toLocaleLowerCase().startsWith("http")) {
+    try {
+      new URL(iri);
+    } catch (error) {
+      iriIsValid = false;
     }
-    return false;
   }
 
-  return true;
+  if (iriIsValid) {
+    return true;
+  }
+
+  if (DEBUG_MODE) {
+    console.log(`IRI failed validation ${iri}`);
+  }
+
+  return false;
 }
diff --git a/utils.test.js b/utils.test.js
@@ -4102,6 +4102,12 @@ test.each([
   ["http://gitlab.com/behat-chrome/chrome-mink-driver.git", true],
   ["git+https://github.com/Alex-D/check-disk-space.git", true],
   ["UNKNOWN", false],
+  ["http://", false],
+  ["http", false],
+  ["https", false],
+  ["https://", false],
+  ["http://www", true],
+  ["http://www.", true],
 ])("isValidIriReference tests: %s", (url, isValid) => {
   expect(isValidIriReference(url)).toBe(isValid);
 });