fix: Add url validation to origin addr in desktop

ui/desktop/electron-app/src/models/session.js

@@ -79,13 +79,14 @@ class Session {
     const sanitized = {
       target_id: sanitizer.base62EscapeAndValidate(this.#targetId),
       token: sanitizer.base62EscapeAndValidate(this.#token),
+      addr: sanitizer.urlValidate(this.#addr),
     };
 
     const command = [
       'connect',
       `-target-id=${sanitized.target_id}`,
       `-token=${sanitized.token}`,
-      `-addr=${this.#addr}`,
+      `-addr=${sanitized.addr}`,
       '-format=json',
     ];
 

ui/desktop/electron-app/src/utils/sanitizer.js

@@ -1,4 +1,4 @@
-const { quote } = require('shell-quote');
+const { URL } = require('url');
 
 module.exports = {
   /**
@@ -18,5 +18,16 @@ module.exports = {
    * @param {string} str
    * @returns {string}
    */
-  shellEscape: (str) => quote([str]),
+  urlValidate: (str) => {
+    try {
+      const url = new URL(str);
+      return url.href;
+    } catch (e) {
+      // Parse error
+      throw new Error(`
+        Could not invoke command:
+        input contained unsafe url.
+      `);
+    }
+  },
 };