From ea0e27301ed3e166f784e2797857a024d999d0b9 Mon Sep 17 00:00:00 2001 From: Sami Date: Tue, 17 Nov 2020 17:41:44 -0500 Subject: [PATCH] readd support for relative urls in ResultLink (#1652) https://coveord.atlassian.net/browse/JSUI-3151 --- src/ui/ResultLink/ResultLink.ts | 7 +++---- unitTests/ui/ResultLinkTest.ts | 12 ++++++++++++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/src/ui/ResultLink/ResultLink.ts b/src/ui/ResultLink/ResultLink.ts index e5f038fe63..c77ccd458a 100644 --- a/src/ui/ResultLink/ResultLink.ts +++ b/src/ui/ResultLink/ResultLink.ts @@ -478,11 +478,10 @@ export class ResultLink extends Component { ); private filterProtocol(uri: string) { - if (/^(https?|ftp|file|mailto|tel):/i.test(uri)) { - return uri; - } + const isAbsolute = /^(https?|ftp|file|mailto|tel):/i.test(uri); + const isRelative = /^\//.test(uri); - return ''; + return isAbsolute || isRelative ? uri : ''; } private getResultUri(): string { diff --git a/unitTests/ui/ResultLinkTest.ts b/unitTests/ui/ResultLinkTest.ts index ea8f7ee369..78089a49a6 100644 --- a/unitTests/ui/ResultLinkTest.ts +++ b/unitTests/ui/ResultLinkTest.ts @@ -359,6 +359,18 @@ export function ResultLinkTest() { expect(test.cmp.element.getAttribute('href')).toEqual(fakeResult.clickUri); }); + it('when the clickUri is a relative url (starts with slash), it sets the href to the uri', () => { + fakeResult.clickUri = '/casemgmt/sc_KnowledgeArticle?sfdcid=ka32C0000009t9CQAQ&type=Solution'; + initHyperLink(); + expect(test.cmp.element.getAttribute('href')).toEqual(fakeResult.clickUri); + }); + + it('when the clickUri is a string containing but not starting with a slash, it sets the href to an empty string', () => { + fakeResult.clickUri = 'casemgmt/sc_KnowledgeArticle'; + initHyperLink(); + expect(test.cmp.element.getAttribute('href')).toEqual(''); + }); + it(`when the uri (clickUri) defined in the results contains the javascript protocol, it clears the value to prevent XSS`, () => { fakeResult.clickUri = 'JavaScript:void(0)';