From 1a0650ff7cee6bc9db6c6a8a381a0de946d43130 Mon Sep 17 00:00:00 2001
From: Susmitha Girumala <susmitha@hashicorp.com>
Date: Fri, 14 May 2021 15:00:24 -0400
Subject: [PATCH] fix: Add url validation to origin validation in desktop

---
 ui/desktop/electron-app/src/ipc/handlers.js    | 6 ++++--
 ui/desktop/electron-app/src/utils/sanitizer.js | 7 ++-----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/ui/desktop/electron-app/src/ipc/handlers.js b/ui/desktop/electron-app/src/ipc/handlers.js
index e3bdcbabd..529fc34a5 100644
--- a/ui/desktop/electron-app/src/ipc/handlers.js
+++ b/ui/desktop/electron-app/src/ipc/handlers.js
@@ -4,6 +4,7 @@ const handle = require('./ipc-handler.js');
 const boundaryCli = require('../cli/index.js');
 const sessionManager = require('../services/session-manager.js');
 const runtimeSettings = require('../services/runtime-settings.js');
+const sanitizer = require('../utils/sanitizer.js');
 
 /**
  * Returns the current runtime origin, which is used by the main thread to
@@ -16,8 +17,9 @@ handle('getOrigin', () => runtimeSettings.origin);
  * a main window reload.
  */
 handle('setOrigin', async (requestOrigin) => {
-  await runtimeSettings.validateOrigin(requestOrigin);
-  runtimeSettings.origin = requestOrigin;
+  const origin = sanitizer.urlValidate(requestOrigin);
+  await runtimeSettings.validateOrigin(origin);
+  runtimeSettings.origin = origin;
 });
 
 /**
diff --git a/ui/desktop/electron-app/src/utils/sanitizer.js b/ui/desktop/electron-app/src/utils/sanitizer.js
index 582f2532c..9e635b0d5 100644
--- a/ui/desktop/electron-app/src/utils/sanitizer.js
+++ b/ui/desktop/electron-app/src/utils/sanitizer.js
@@ -21,13 +21,10 @@ module.exports = {
   urlValidate: (str) => {
     try {
       const url = new URL(str);
-      return url.href;
+      return `${url.protocol}://${url.host}`;
     } catch (e) {
       // Parse error
-      throw new Error(`
-        Could not invoke command:
-        input contained unsafe url.
-      `);
+      throw new Error(`URL ${str} could not be validated.`);
     }
   },
 };