gortium/openconcho
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden token and URL handling

Browse Source 
* fix: harden token and URL handling

* test: restore full web test suite

---------

Co-authored-by: batumilove <batumilove@users.noreply.github.com>
This commit is contained in:
batumilove
2026-05-28 05:31:46 +04:00
committed by Offending Commit
parent 6960bf4ffe
commit 5cfbae6248
11 changed files with 152 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
packages/web/src/components/workspaces/WebhookManager.tsx
View File

@@ -13,8 +13,12 @@ import { Input } from "@/components/ui/input";
import { Body, Muted, PageTitle, SectionHeading } from "@/components/ui/typography";
import { useDemo } from "@/hooks/useDemo";
import { COLOR } from "@/lib/constants";
import { isHttpOrHttpsUrl, isSafeExternalUrl } from "@/lib/security";
const urlSchema = z.string().url({ message: "Must be a valid URL" });
const urlSchema = z
.string()
.url({ message: "Must be a valid URL" })
.refine(isHttpOrHttpsUrl, { message: "Webhook URL must use http or https" });
interface Props {
workspaceId: string;
@@ -50,6 +54,15 @@ export function WebhookManager({ workspaceId }: Props) {
setTimeout(() => setTestResult(null), 5000);
};
const handleOpenWebhook = async (webhookUrl: string) => {
if (!isSafeExternalUrl(webhookUrl)) {
setTestResult(`Blocked unsafe webhook URL: ${webhookUrl}`);
setTimeout(() => setTestResult(null), 5000);
return;
}
await open(webhookUrl);
};
const list = Array.isArray(webhooks) ? webhooks : [];
return (
@@ -161,7 +174,7 @@ export function WebhookManager({ workspaceId }: Props) {
</span>
<button
type="button"
onClick={() => void open((wh as { url: string }).url)}
onClick={() => void handleOpenWebhook((wh as { url: string }).url)}
className="flex-shrink-0"
style={{
color: "var(--text-4)",