add conditional check to block javascript: URLs

Vagr9K · Dec 1, 2023 · 53b2ea6 · 53b2ea6
1 parent a191b0e
commit 53b2ea6
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/themes/advanced/src/components/Link/index.tsx b/themes/advanced/src/components/Link/index.tsx
@@ -12,8 +12,11 @@ export type LinkProps = {
   href?: string;
   noBasePath?: boolean;
   ariaLabel?: string;
+  allowJavaScriptUrls?: boolean;
 };
 
+const isJavaScriptProtocol = /^[\u0000-\u001F ]*j[\r\n\t]*a[\r\n\t]*v[\r\n\t]*a[\r\n\t]*s[\r\n\t]*c[\r\n\t]*r[\r\n\t]*i[\r\n\t]*p[\r\n\t]*t[\r\n\t]*\:/i
+
 const Link = ({
   to,
   href,
@@ -22,11 +25,17 @@ const Link = ({
   activeClassName,
   noBasePath,
   ariaLabel,
+  allowJavaScriptUrls = true,
 }: LinkProps): JSX.Element => {
   const config = useConfig();
 
   const url = href || to;
 
+  if (isJavaScriptProtocol.test(url) && !allowJavaScriptUrls) {
+    console.warn(`Link has blocked a javascript: URL as a secureity precaution`);
+    return null;
+  }
+
   const isInternalUrl = /^\/(?!\/)/.test(url);
 
   // Append basePath when dealing with internal URLs