From fc7d8a3d081d3a2acb0b975aa25fa72812b9d28a Mon Sep 17 00:00:00 2001
From: Caleb Roseland <caleb@calebroseland.com>
Date: Wed, 18 Oct 2023 16:56:14 -0500
Subject: [PATCH] include encoded

---
 app/utils/deep_link/index.ts |  7 ++++++-
 app/utils/url/test.ts        | 38 +++++++++++++++++++++++++-----------
 2 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/app/utils/deep_link/index.ts b/app/utils/deep_link/index.ts
index 7b2bb982d..bfa9e18ac 100644
--- a/app/utils/deep_link/index.ts
+++ b/app/utils/deep_link/index.ts
@@ -118,7 +118,12 @@ export function parseDeepLink(deepLinkUrl: string): DeepLinkWithData {
     try {
         const url = removeProtocol(decodeURIComponent(deepLinkUrl));
 
-        if (url.includes('../') || url.includes('/..')) {
+        if (
+            url.includes('../') ||
+            url.includes('/..') ||
+            url.includes('..%2f') ||
+            url.includes('%2f..')
+        ) {
             return {type: DeepLink.Invalid, url: deepLinkUrl};
         }
 
diff --git a/app/utils/url/test.ts b/app/utils/url/test.ts
index f7057e1f4..c47d5ee64 100644
--- a/app/utils/url/test.ts
+++ b/app/utils/url/test.ts
@@ -139,22 +139,22 @@ describe('UrlUtils', () => {
             {
                 name: 'should return null if all inputs are empty',
                 input: {url: '', serverURL: '', siteURL: ''},
-                expected: {type: 'invalid'},
+                expected: {type: DeepLinkType.Invalid},
             },
             {
                 name: 'should return null if any of the input is null',
                 input: {url: '', serverURL: '', siteURL: null},
-                expected: {type: 'invalid'},
+                expected: {type: DeepLinkType.Invalid},
             },
             {
                 name: 'should return null if any of the input is null',
                 input: {url: '', serverURL: null, siteURL: ''},
-                expected: {type: 'invalid'},
+                expected: {type: DeepLinkType.Invalid},
             },
             {
                 name: 'should return null if any of the input is null',
                 input: {url: null, serverURL: '', siteURL: ''},
-                expected: {type: 'invalid'},
+                expected: {type: DeepLinkType.Invalid},
             },
             {
                 name: 'should return null for not supported link',
@@ -163,12 +163,12 @@ describe('UrlUtils', () => {
                     serverURL: SERVER_URL,
                     siteURL: SITE_URL,
                 },
-                expected: {type: 'invalid'},
+                expected: {type: DeepLinkType.Invalid},
             },
             {
                 name: 'should return null despite url subset match',
                 input: {url: 'http://myserver.com', serverURL: 'http://myserver.co'},
-                expected: {type: 'invalid'},
+                expected: {type: DeepLinkType.Invalid},
             },
             {
                 name: 'should match despite no server URL in input link',
@@ -186,6 +186,24 @@ describe('UrlUtils', () => {
                     type: DeepLinkType.Permalink,
                 },
             },
+            {
+                name: 'should return null for invalid deeplink',
+                input: {
+                    url: DEEPLINK_URL_ROOT + '/ad-1/channels/../town-square',
+                    serverURL: SERVER_URL,
+                    siteURL: SITE_URL,
+                },
+                expected: {type: DeepLinkType.Invalid},
+            },
+            {
+                name: 'should return null for encoded invalid deeplink',
+                input: {
+                    url: DEEPLINK_URL_ROOT + '/ad-1/channels/%252f..%252ftown-square',
+                    serverURL: SERVER_URL,
+                    siteURL: SITE_URL,
+                },
+                expected: {type: DeepLinkType.Invalid},
+            },
             {
                 name: 'should match channel link',
                 input: {
@@ -247,7 +265,7 @@ describe('UrlUtils', () => {
                         serverUrl: URL_PATH_NO_PROTOCOL,
                         teamName: 'ad-1',
                     },
-                    type: 'permalink',
+                    type: DeepLinkType.Permalink,
                 },
             },
             {
@@ -263,7 +281,7 @@ describe('UrlUtils', () => {
                         serverUrl: URL_PATH_NO_PROTOCOL,
                         teamName: 'ad-1',
                     },
-                    type: 'permalink',
+                    type: DeepLinkType.Permalink,
                 },
             },
             {
@@ -273,9 +291,7 @@ describe('UrlUtils', () => {
                     serverURL: SERVER_WITH_SUBPATH,
                     siteURL: SERVER_WITH_SUBPATH,
                 },
-                expected: {
-                    type: 'invalid',
-                },
+                expected: {type: DeepLinkType.Invalid},
             },
         ];