XSS in social links block in NFT Collection & Profile

[LetikGit]

Bug Type

Functional

Reproduction steps

via #5

1. Go to profile OR to create NFT Collection
2. Place breakpoints to request (edit profile / create nft collection)
3. Replace URL param to payload, as example
   {type: "Website", url: "javascript:alert(document.cookie)"}
4. Send request
5. Go to profile OR created NFT collection
6. Click on link with payload from socialLinks component

Actual result

XSS

2022-09-17.07.52.30.mp4

Expected result

Don't allow "clear" links, add 'https' to start

Suggested Severity

Vulnerability

Device

OS: macOS
Browser chrome
Version 105

Additional Context

No response

[LetikGit]

Reported this problem over the weekend, with PO decided that the problem after the fix can be disclosed publicly.