Skip to content

Commit 167f9bb

Browse files
authored
Merge pull request #28 from gtsp233/fix-javascript-url
feat: sanitize javascript url
2 parents 468f9c5 + c5bbc31 commit 167f9bb

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

src/lib/src/components/NavBar/NavBarLink/index.js

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
import React from "react";
22

3+
const isJavaScriptProtocol = /^[\u0000-\u001F ]*j[\r\n\t]*a[\r\n\t]*v[\r\n\t]*a[\r\n\t]*s[\r\n\t]*c[\r\n\t]*r[\r\n\t]*i[\r\n\t]*p[\r\n\t]*t[\r\n\t]*\:/i
4+
35
const NavBarLink = (props) => {
46

57
const {
@@ -12,9 +14,15 @@ const NavBarLink = (props) => {
1214
onClick,
1315
showBadge,
1416
imgBorderRadius,
15-
badgeBackgroundColor
17+
badgeBackgroundColor,
18+
allowJavaScriptUrls = true
1619
} = props;
1720

21+
if (isJavaScriptProtocol.test(href) && !allowJavaScriptUrls) {
22+
console.warn(`NavBarLink has blocked a javascript: URL as a security precaution`);
23+
return null;
24+
}
25+
1826
const renderBadge = () => {
1927
if(showBadge > 0 || showBadge !== "") {
2028
return <div className="app-badge"

0 commit comments

Comments
 (0)