Repository navigation
[CONS-1091] Harbor renders catalog links without checking they are web URLs - #209
Conversation
Upgrade, purchase and activation links came from the catalog and were rendered whatever their scheme, so a javascript: or data: value would become a working wp-admin link. They now share the http(s) check the NPS upsell offers already used, and anything else renders no link.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches
Comment |
|
@coderabbitai full review |
|
Purchase and upgrade URLs are kept only when their scheme is http(s), then passed through esc_url_raw(). The scheme is checked first because esc_url_raw() prepends http:// to schemeless input. Sanitizing in from_array() also cleans catalogs already cached in the state option.
defunctl
left a comment
defunctl
left a comment
There was a problem hiding this comment.
The catalog URL checks look good. I ran the existing JS suite locally and all 166 tests passed. I also added two temporary component tests while reviewing, and both exposed gaps in the activation handling. Let's cover those before merging.
These are validation gaps, not a confirmed remote exploit. The activation URL normally comes from Harbor's configured Portal URL.
The activation and subscriptions URLs were rendered unchecked, and activation controls decided whether to show from the raw URL, so a rejected one left a visible control with no destination. Each control now shows only when it has a validated link.
defunctl
left a comment
defunctl
left a comment
There was a problem hiding this comment.
Both issues from my earlier review are fixed, including hiding activation controls when the URL is rejected. The subscription links are covered too. I reran all 185 JS tests, the 14 PHP catalog tests and TypeScript checks, and both frontend builds compile. Looks good to merge.
2 participants
🎫 Ticket
CONS-1091
🗒️ Description
Renders catalog upgrade, purchase and activation links only when they are http(s), using the check the NPS upsell offers already applied.
Based on #205.