Fix to not link nodes outside baseUrl

collective · Jul 25, 2019 · e26b7f3 · e26b7f3
1 parent abfe073
commit e26b7f3
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 7 deletions.
diff --git a/src/__tests__/utils.tests.js b/src/__tests__/utils.tests.js
@@ -213,13 +213,16 @@ test('normalizeData maps @id to _id and _path', async () => {
 
 test('normalizeData prefixes id, parent and children with _', async () => {
   expect(
-    normalizeData({
-      id: '',
-      parent: {
-        '@id': 'http://localhost:8080/Plone',
+    normalizeData(
+      {
+        id: '',
+        parent: {
+          '@id': 'http://localhost:8080/Plone',
+        },
+        children: [],
       },
-      children: [],
-    })
+      'http://localhost:8080/Plone'
+    )
   ).toEqual({
     _id: '',
     _parent: {
@@ -231,6 +234,28 @@ test('normalizeData prefixes id, parent and children with _', async () => {
   });
 });
 
+test('normalizeData excludes node___NODE when @id outside baseUrl', async () => {
+  expect(
+    normalizeData(
+      {
+        id: '',
+        parent: {
+          '@id': 'http://localhost:8080/Foo',
+        },
+        children: [],
+      },
+      'http://localhost:8080/Plone'
+    )
+  ).toEqual({
+    _id: '',
+    _parent: {
+      _id: 'http://localhost:8080/Foo',
+      _path: '/',
+    },
+    _children: [],
+  });
+});
+
 test('normalizeData drops /view suffix from id', async () => {
   expect(
     normalizeData(

diff --git a/src/utils.js b/src/utils.js
@@ -149,7 +149,13 @@ export const normalizeData = function(data, baseUrl, depth = 0) {
       delete data[key];
     } else if (key.length && key[0] === '@') {
       data['_' + key.slice(1)] = value;
-      if (key === '@id' && depth > 0 && value.match('@') === null) {
+      if (
+        key === '@id' &&
+        depth > 0 &&
+        value &&
+        value.startsWith(baseUrl) &&
+        value.match('@') === null
+      ) {
         data.node___NODE = value;
       }
       delete data[key];