Jaymr/new-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ui): enforce HTTPS for backend-provided image URLs and improve URL validation

Browse Source
This commit is contained in:
CaIon
2026-06-18 14:56:44 +08:00
parent 06f9dec95b
commit 1aa77e6698
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/default/src/features/wallet/lib/ui.tsx
Vendored
+7 -9
View File
@@ -27,26 +27,24 @@ import { PAYMENT_TYPES, PAYMENT_ICON_COLORS } from '../constants'
// UI Helper Functions
// ============================================================================
const HAS_LOCATION =
typeof globalThis !== 'undefined' && 'location' in globalThis
/**
* Resolves a backend-provided image URL to http(s) only. Rejects javascript:,
* data:, blob:, file:, and URLs with userinfo, which are unsafe in <img src/>.
* Resolves a backend-provided image URL to https only. Rejects http:,
* data:, blob:, file:, relative paths, and URLs with userinfo, which are unsafe
* or ambiguous in <img src/>.
*/
function normalizeHttpIconUrl(raw: string | undefined | null): string | null {
if (!raw) return null
const s = raw.trim()
if (!s) return null
if (!/^https:\/\//i.test(s)) return null
let url: URL
try {
url = HAS_LOCATION
? new URL(s, (globalThis as { location: Location }).location.href)
: new URL(s)
url = new URL(s)
} catch {
return null
}
if (url.protocol !== 'http:' && url.protocol !== 'https:') {
if (url.protocol !== 'https:') {
return null
}
if (url.username || url.password) {