From fda3ca9d4b51c48a5cc254991662e95fc84bd47a Mon Sep 17 00:00:00 2001 From: Cameron Perera Date: Fri, 13 Sep 2024 13:03:40 -0500 Subject: [PATCH] =?UTF-8?q?fix:=20=F0=9F=90=9B=20add=20regex=20literal=20f?= =?UTF-8?q?or=20isLocalHost=20check=20(#2484)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: 🐛 add ':' to isLocalHost check ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-13242 * refactor: 💡 use regex to verify href is localhost ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-13242 --- ui/desktop/electron-app/src/ipc/handlers.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ui/desktop/electron-app/src/ipc/handlers.js b/ui/desktop/electron-app/src/ipc/handlers.js index bf058a24b..8207eb035 100644 --- a/ui/desktop/electron-app/src/ipc/handlers.js +++ b/ui/desktop/electron-app/src/ipc/handlers.js @@ -44,9 +44,10 @@ handle('resetClusterUrl', async () => runtimeSettings.resetClusterUrl()); * testing workflows). Insecure URLs are allowed in dev mode. */ handle('openExternal', async (href) => { + const localhostRegex = /^http:\/\/(localhost|127\.0\.0\.1):\d{1,5}(?:\/|$)/i; + const isLocalhost = localhostRegex.test(href); const isSecure = href.startsWith('https://'); - const isLocalhost = - href.startsWith('http://localhost') || href.startsWith('http://127.0.0.1'); + if (isSecure || isLocalhost || isDev) { /** * Launch browser to display documentation and to support arbitrary OIDC flows