fix security 1

2026-07-26 16:21:58 +02:00
parent a075d06b6d
commit 364af50a7c
9 changed files with 57 additions and 18 deletions
@@ -0,0 +1,26 @@
+export function safeAppUrl(value, fallback = "/") {
+  try {
+    const url = new URL(String(value || ""), location.origin);
+    if (url.origin !== location.origin || !["http:", "https:"].includes(url.protocol)) return fallback;
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return fallback;
+  }
+}
+
+export function safePublicUrl(value, { allowMailto = true } = {}) {
+  const raw = String(value || "").trim();
+  if (!raw || raw.startsWith("//")) return "#";
+  try {
+    const url = new URL(raw, location.origin);
+    if (url.protocol === "mailto:" && allowMailto) return url.href;
+    if (!["http:", "https:"].includes(url.protocol)) return "#";
+    return url.href;
+  } catch {
+    return "#";
+  }
+}
+
+export function safeHexColor(value, fallback = "#64748b") {
+  return /^#[0-9a-f]{6}$/i.test(String(value || "")) ? String(value) : fallback;
+}