diff --git a/app/utils/deep_link/index.ts b/app/utils/deep_link/index.ts index bfa9e18ac..1776e75ce 100644 --- a/app/utils/deep_link/index.ts +++ b/app/utils/deep_link/index.ts @@ -118,12 +118,7 @@ export function parseDeepLink(deepLinkUrl: string): DeepLinkWithData { try { const url = removeProtocol(decodeURIComponent(deepLinkUrl)); - if ( - url.includes('../') || - url.includes('/..') || - url.includes('..%2f') || - url.includes('%2f..') - ) { + if (isDeepLinkInvalid(url)) { return {type: DeepLink.Invalid, url: deepLinkUrl}; } @@ -158,6 +153,11 @@ export function parseDeepLink(deepLinkUrl: string): DeepLinkWithData { return {type: DeepLink.Invalid, url: deepLinkUrl}; } +function isDeepLinkInvalid(decodedUrl: string) { + const url = decodeURIComponent(decodedUrl); + return url.includes('../') || url.includes('/..'); +} + export function matchDeepLink(url?: string, serverURL?: string, siteURL?: string) { if (!url || (!serverURL && !siteURL)) { return ''; diff --git a/app/utils/url/test.ts b/app/utils/url/test.ts index c47d5ee64..c5e526961 100644 --- a/app/utils/url/test.ts +++ b/app/utils/url/test.ts @@ -196,9 +196,9 @@ describe('UrlUtils', () => { expected: {type: DeepLinkType.Invalid}, }, { - name: 'should return null for encoded invalid deeplink', + name: 'should return null for double encoded invalid deeplink', input: { - url: DEEPLINK_URL_ROOT + '/ad-1/channels/%252f..%252ftown-square', + url: DEEPLINK_URL_ROOT + '/ad-1/channels/%252f%252e.town-square', serverURL: SERVER_URL, siteURL: SITE_URL, },