Sanitize iframe src attribute's input

lib/middleware/testRunner/TestRunner.js

@@ -70,6 +70,24 @@
 
 	var oXHRQueue = new XHRQueue(50, 2);
 
+	function sanitizeUrl(potentialUrl) {
+		var validUrl;
+		try {
+			validUrl = new URL(potentialUrl);
+			return validUrl.href;
+		} catch (e) {/* It could be a relative URL and we'll give it another try with the current domain name */}
+
+		try {
+			var url = [window.location.origin, potentialUrl].join(
+				potentialUrl[0] === "/" ? "" : "/"
+			);
+			validUrl = new URL(url);
+			return validUrl.href;
+		} catch (error) {
+			return ""; // The potentialUrl so far didn't prove to be a valid url, so return an empty string.
+		}
+	}
+
 	/*
 	 * Template for test results
 	 */
@@ -166,7 +184,7 @@
 								}.bind(this));
 							}
 						});
-						$frame.attr("src", sTestPage);
+						$frame.attr("src", sanitizeUrl(sTestPage));
 						$frame.appendTo(document.body);
 					} else {
 						resolve([sTestPage]);
@@ -358,7 +376,7 @@
 						width: "1280px"
 					});
 
-					$frame.attr("src", sTestPage);
+					$frame.attr("src", sanitizeUrl(sTestPage));
 					var $framediv = jQuery("<div>").css({
 						height: "400px",
 						width: "100%",