ADA-ARGO-SA-01: help.chatUrl should be validated

[crenshaw-dev]

It can currently be a javascript: link. Only admins can set this value, so it's reasonably safe. But it's probably better to URL validate that value to help admins avoid doing something dangerous.

[saumeya]

I'd like to work on this, what does javascript: link mean @crenshaw-dev

[crenshaw-dev]

@saumeya, I believe the href attribute for the "chat" button can start with javascript: , meaning it can be used to run arbitrary JavaScript code instead of navigating to an external page. If I were a malicious Argo CD admin, I could embed code in that href to take malicious actions using the victim's credentials (do things like deleting an app).

The fix could make use of some of this validation code: 8bc3ef6

[crenshaw-dev]

Just to clarify: if someone is an Argo CD admin, there are a lot more malicious things they can do than this. So this isn't really a vulnerability. It would just be good to add an extra layer of protection. :-)