fix: Add url validation to origin validation in desktop

ui/desktop/electron-app/src/ipc/handlers.js

@@ -4,6 +4,7 @@ const handle = require('./ipc-handler.js');
 const boundaryCli = require('../cli/index.js');
 const sessionManager = require('../services/session-manager.js');
 const runtimeSettings = require('../services/runtime-settings.js');
+const sanitizer = require('../utils/sanitizer.js');
 
 /**
  * Returns the current runtime origin, which is used by the main thread to
@@ -16,8 +17,9 @@ handle('getOrigin', () => runtimeSettings.origin);
  * a main window reload.
  */
 handle('setOrigin', async (requestOrigin) => {
-  await runtimeSettings.validateOrigin(requestOrigin);
-  runtimeSettings.origin = requestOrigin;
+  const origin = sanitizer.urlValidate(requestOrigin);
+  await runtimeSettings.validateOrigin(origin);
+  runtimeSettings.origin = origin;
 });
 
 /**

ui/desktop/electron-app/src/utils/sanitizer.js

@@ -21,13 +21,10 @@ module.exports = {
   urlValidate: (str) => {
     try {
       const url = new URL(str);
-      return url.href;
+      return `${url.protocol}://${url.host}`;
     } catch (e) {
       // Parse error
-      throw new Error(`
-        Could not invoke command:
-        input contained unsafe url.
-      `);
+      throw new Error(`URL ${str} could not be validated.`);
     }
   },
 };