Fix Bug 1448911 - Allow only http/https in URL fields

This will also fix bug 1423329
mozilla · Apr 3, 2018 · 93a05af · 93a05af
1 parent b1b1c50
commit 93a05af
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 8 deletions.
diff --git a/system-addon/content-src/components/TopSites/TopSiteForm.jsx b/system-addon/content-src/components/TopSites/TopSiteForm.jsx
@@ -123,14 +123,21 @@ export class TopSiteForm extends React.PureComponent {
     return url;
   }
 
-  validateUrl(url) {
+  _tryParseUrl(url) {
     try {
-      return !!new URL(this.cleanUrl(url));
+      return new URL(url);
     } catch (e) {
-      return false;
+      return null;
     }
   }
 
+  validateUrl(url) {
+    const validProtocols = ["http:", "https:"];
+    const urlObj = this._tryParseUrl(url) || this._tryParseUrl(this.cleanUrl(url));
+
+    return urlObj && validProtocols.includes(urlObj.protocol);
+  }
+
   validateCustomScreenshotUrl() {
     const {customScreenshotUrl} = this.state;
     return !customScreenshotUrl || this.validateUrl(customScreenshotUrl);

diff --git a/system-addon/test/unit/content-src/components/TopSites.test.jsx b/system-addon/test/unit/content-src/components/TopSites.test.jsx
@@ -592,7 +592,7 @@ describe("<TopSiteForm>", () => {
     it("should return false for a incorrect URL", () => {
       wrapper.setState({url: " "});
 
-      assert.isFalse(wrapper.instance().validateForm());
+      assert.isNull(wrapper.instance().validateForm());
       assert.isTrue(wrapper.state().validationError);
     });
 
@@ -605,14 +605,20 @@ describe("<TopSiteForm>", () => {
     it("should return false for a incorrect custom screenshot URL", () => {
       wrapper.setState({customScreenshotUrl: " "});
 
-      assert.isFalse(wrapper.instance().validateForm());
+      assert.isNull(wrapper.instance().validateForm());
     });
 
     it("should return true for an empty custom screenshot URL", () => {
-      wrapper.setState({customScreenshotURL: ""});
+      wrapper.setState({customScreenshotUrl: ""});
 
       assert.isTrue(wrapper.instance().validateForm());
     });
+
+    it("should return false for file: protocol", () => {
+      wrapper.setState({customScreenshotUrl: "file:///C:/Users/foo"});
+
+      assert.isFalse(wrapper.instance().validateForm());
+    });
   });
 
   describe("#previewButton", () => {
@@ -903,8 +909,8 @@ describe("<TopSiteForm>", () => {
       assert.ok(wrapper.instance().validateUrl("https://mozilla.invisionapp.com/d/main/#/projects/prototypes"));
       assert.ok(wrapper.instance().validateUrl("httpfoobar"));
       assert.ok(wrapper.instance().validateUrl("httpsfoo.bar"));
-      assert.isFalse(wrapper.instance().validateUrl("mozilla org"));
-      assert.isFalse(wrapper.instance().validateUrl(""));
+      assert.isNull(wrapper.instance().validateUrl("mozilla org"));
+      assert.isNull(wrapper.instance().validateUrl(""));
     });
   });