Improving the urls to not break protocols and adding tests

shared/constants.ts

@@ -1,3 +1,6 @@
 export const USER_PRESENCE_INTERVAL = 5000;
 
 export const MAX_AVATAR_DISPLAY = 6;
+
+// Protocols that need to be sanitized
+export const blockedProtocols = ["javascript://", "file://"];

shared/utils/urls.test.ts

@@ -67,4 +67,15 @@ describe("sanitizeUrl Method", () => {
       );
     });
   });
+
+  describe("Blocked protocols", () => {
+    it("should be sanitized", () => {
+      expect(urlsUtils.sanitizeUrl("file://localhost/outline.txt")).toEqual(
+        "https://file://localhost/outline.txt"
+      );
+      expect(urlsUtils.sanitizeUrl("javascript://whatever")).toEqual(
+        "https://javascript://whatever"
+      );
+    });
+  });
 });

shared/utils/urls.ts

@@ -1,3 +1,4 @@
+import { blockedProtocols } from "../constants";
 import env from "../env";
 import { parseDomain } from "./domains";
 
@@ -86,12 +87,14 @@ export function sanitizeUrl(url: string | null | undefined) {
     return undefined;
   }
 
+  const protocol = url.match(/(\w+):\/\//);
+
   if (
-    !isUrl(url) &&
-    !url.startsWith("/") &&
-    !url.startsWith("#") &&
-    !url.startsWith("mailto:") &&
-    !url.includes("://")
+    (!isUrl(url) &&
+      !url.startsWith("/") &&
+      !url.startsWith("#") &&
+      !url.startsWith("mailto:")) ||
+    (protocol && blockedProtocols.includes(protocol[0]))
   ) {
     return `https://${url}`;
   }