diff --git a/elements/routing.js b/elements/routing.js index f28c1e5003..1c3037cce8 100644 --- a/elements/routing.js +++ b/elements/routing.js @@ -27,22 +27,34 @@ function scrollToTop(ctx, next) { next(); } -function getTrustedDomains(path) { +function createUrlFromString(str) { + const httpRegex = /^https?:\/\//; + const wwwRegex = /www\./; + str = httpRegex.test(str) ? str : `http://${str}`; + str = wwwRegex.test(str) ? str : str.replace(/^(https?:\/\/)?/, '$1www.'); + return str; +} + +function isTrustedDomain(path) { const trustedDomains = Nuxeo && Nuxeo.UI && Nuxeo.UI.config && Nuxeo.UI.config.trustedDomains; - const pathUrl = new URL(path); - const { hostname } = pathUrl; - const queryParams = pathUrl.search.split('?')[1]; - const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path; - if (!trustedDomains) return { encodepath, isvalidUrl: true }; + if (!trustedDomains) return true; + const modifiedPathUrl = createUrlFromString(path); + const pathUrl = new URL(modifiedPathUrl); + const { hostname: userHostName } = pathUrl; const trustedDomainList = trustedDomains.split(','); - const isvalidUrl = trustedDomainList.some((url) => { - const isFullpath = /^http(s)?:\/\//.test(url); - const parsedURL = isFullpath ? url : `https://${url}`; - const { hostname: currentUrlhost } = new URL(parsedURL); - return currentUrlhost.toLowerCase() === hostname.toLowerCase(); + const isValidUrl = trustedDomainList.some((url) => { + const updatedUrl = createUrlFromString(url); + const { hostname: currentUrlHostName } = new URL(updatedUrl); + return currentUrlHostName?.toLowerCase() === userHostName?.toLowerCase(); }); + return isValidUrl; +} - return { encodepath, isvalidUrl }; +function encodeQueryParams(path) { + const pathUrl = new URL(path); + const queryParams = pathUrl.search.split('?')[1]; + const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path; + return encodepath; } function _routeAdmin(selectedAdminTab, errorPath, routeData) { @@ -214,8 +226,9 @@ app.router = { } const isFullpath = /^http(s)?:\/\//.test(path); if (isFullpath) { - const { encodepath, isvalidUrl } = getTrustedDomains(path); - if (isvalidUrl) { + const isValidUrl = isTrustedDomain(path); + if (isValidUrl) { + const encodepath = encodeQueryParams(path); const link = document.createElement('a'); link.setAttribute('href', encodepath); link.click(); diff --git a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml index b7dfd741f3..4d3d20fdfe 100644 --- a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml +++ b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml @@ -52,7 +52,7 @@ - ${nuxeo.trustedDomains} - + ${org.nuxeo.web.ui.trustedDomains:=''} + - + \ No newline at end of file