From 744d5c11203c5602c76850752ccf8efcbc8e6e41 Mon Sep 17 00:00:00 2001
From: Caleb Roseland <caleb@calebroseland.com>
Date: Fri, 3 Nov 2023 14:46:00 -0500
Subject: [PATCH] include backslashes

---
 app/utils/deep_link/index.ts |  2 +-
 app/utils/url/test.ts        | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/app/utils/deep_link/index.ts b/app/utils/deep_link/index.ts
index 1776e75ce..41abb8e20 100644
--- a/app/utils/deep_link/index.ts
+++ b/app/utils/deep_link/index.ts
@@ -155,7 +155,7 @@ export function parseDeepLink(deepLinkUrl: string): DeepLinkWithData {
 
 function isDeepLinkInvalid(decodedUrl: string) {
     const url = decodeURIComponent(decodedUrl);
-    return url.includes('../') || url.includes('/..');
+    return Boolean((/([/\\]\.\.|\.\.[/\\])/).exec(url)?.length);
 }
 
 export function matchDeepLink(url?: string, serverURL?: string, siteURL?: string) {
diff --git a/app/utils/url/test.ts b/app/utils/url/test.ts
index c5e526961..ea0210586 100644
--- a/app/utils/url/test.ts
+++ b/app/utils/url/test.ts
@@ -195,6 +195,24 @@ describe('UrlUtils', () => {
                 },
                 expected: {type: DeepLinkType.Invalid},
             },
+            {
+                name: 'should return null for backslash-invalid deeplink',
+                input: {
+                    url: DEEPLINK_URL_ROOT + '/ad-1/channels/\\..town-square',
+                    serverURL: SERVER_URL,
+                    siteURL: SITE_URL,
+                },
+                expected: {type: DeepLinkType.Invalid},
+            },
+            {
+                name: 'should return null for backslash-invalid-alt deeplink',
+                input: {
+                    url: DEEPLINK_URL_ROOT + '/ad-1/channels/t..\\town-square',
+                    serverURL: SERVER_URL,
+                    siteURL: SITE_URL,
+                },
+                expected: {type: DeepLinkType.Invalid},
+            },
             {
                 name: 'should return null for double encoded invalid deeplink',
                 input: {
@@ -204,6 +222,15 @@ describe('UrlUtils', () => {
                 },
                 expected: {type: DeepLinkType.Invalid},
             },
+            {
+                name: 'should return null for double encoded backslash-invalid deeplink',
+                input: {
+                    url: DEEPLINK_URL_ROOT + '/ad-1/channels/%255C%252e.town-square',
+                    serverURL: SERVER_URL,
+                    siteURL: SITE_URL,
+                },
+                expected: {type: DeepLinkType.Invalid},
+            },
             {
                 name: 'should match channel link',
                 input: {