From 1397df807f83d144ee563822f74fbde525b94073 Mon Sep 17 00:00:00 2001
From: Susmitha Girumala <susmitha@hashicorp.com>
Date: Fri, 14 May 2021 10:40:50 -0400
Subject: [PATCH] fix: Add url validation to origin addr in desktop

---
 ui/desktop/electron-app/src/models/session.js  |  3 ++-
 ui/desktop/electron-app/src/utils/sanitizer.js | 15 +++++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/ui/desktop/electron-app/src/models/session.js b/ui/desktop/electron-app/src/models/session.js
index 20d5b37a4..6ec9d3ce8 100644
--- a/ui/desktop/electron-app/src/models/session.js
+++ b/ui/desktop/electron-app/src/models/session.js
@@ -79,13 +79,14 @@ class Session {
     const sanitized = {
       target_id: sanitizer.base62EscapeAndValidate(this.#targetId),
       token: sanitizer.base62EscapeAndValidate(this.#token),
+      addr: sanitizer.urlValidate(this.#addr),
     };
 
     const command = [
       'connect',
       `-target-id=${sanitized.target_id}`,
       `-token=${sanitized.token}`,
-      `-addr=${this.#addr}`,
+      `-addr=${sanitized.addr}`,
       '-format=json',
     ];
 
diff --git a/ui/desktop/electron-app/src/utils/sanitizer.js b/ui/desktop/electron-app/src/utils/sanitizer.js
index bc48fe0cf..582f2532c 100644
--- a/ui/desktop/electron-app/src/utils/sanitizer.js
+++ b/ui/desktop/electron-app/src/utils/sanitizer.js
@@ -1,4 +1,4 @@
-const { quote } = require('shell-quote');
+const { URL } = require('url');
 
 module.exports = {
   /**
@@ -18,5 +18,16 @@ module.exports = {
    * @param {string} str
    * @returns {string}
    */
-  shellEscape: (str) => quote([str]),
+  urlValidate: (str) => {
+    try {
+      const url = new URL(str);
+      return url.href;
+    } catch (e) {
+      // Parse error
+      throw new Error(`
+        Could not invoke command:
+        input contained unsafe url.
+      `);
+    }
+  },
 };