fix: treat non-http/https login urls as invalid

isaacs · isaacs · commit 6bcf0860a384 · 2020-02-28T10:11:11.000-08:00
diff --git a/lib/index.js b/lib/index.js
@@ -23,7 +23,7 @@ const url = require('url')
 const isValidUrl = u => {
   if (u && typeof u === 'string') {
     const p = url.parse(u)
-    return !!(p.protocol && p.slashes && p.host && p.path)
+    return p.slashes && p.host && p.path && /^https?:$/.test(p.protocol)
   }
   return false
 }
diff --git a/lib/test/login.js b/lib/test/login.js
@@ -137,7 +137,7 @@ const server = http.createServer((q, s) => {
 
       case '/invalid-login-url/-/v1/login':
         return respond(s, 200, {
-          loginUrl: 'this is not a url',
+          loginUrl: 'ftp://this.is/not-a-webpage/now/is/it?',
           doneUrl: reg + '/invalid-done/-/v1/login'
         })
 
@@ -418,7 +418,7 @@ t.test('fail at login step by having an invalid url', t => {
     method: 'POST',
     uri: reg + '/invalid-login-url/-/v1/login',
     body: {
-      loginUrl: 'this is not a url',
+      loginUrl: 'ftp://this.is/not-a-webpage/now/is/it?',
       doneUrl: reg + '/invalid-done/-/v1/login'
     },
     message: 'Invalid response from web login endpoint'

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ const url = require('url')`
`23`	`23`	`const isValidUrl = u => {`
`24`	`24`	`if (u && typeof u === 'string') {`
`25`	`25`	`const p = url.parse(u)`
`26`		`- return !!(p.protocol && p.slashes && p.host && p.path)`
	`26`	`+ return p.slashes && p.host && p.path && /^https?:$/.test(p.protocol)`
`27`	`27`	`}`
`28`	`28`	`return false`
`29`	`29`	`}`