CVE-2023-26140: fix: stronger enforcement of normalizeLink (#6728) · excalidraw/excalidraw@b33fa6d

Expand Up

@@ -29,6 +29,7 @@ import { getTooltipDiv, updateTooltipPosition } from "…/components/Tooltip";

import { getSelectedElements } from "…/scene";

import { isPointHittingElementBoundingBox } from "./collision";

import { getElementAbsoluteCoords } from "./";

import { isLocalLink, normalizeLink } from "…/data/url";

import "./Hyperlink.scss";

import { trackEvent } from "…/analytics";

Expand Down Expand Up

@@ -166,7 +167,7 @@ export const Hyperlink = ({

/>

) : (

<a

href={element.link || ""}

href={normalizeLink(element.link || “”)}

className={clsx("excalidraw-hyperlinkContainer-link", {

"d-none": isEditing,

})}

Expand All

@@ -177,7 +178,13 @@ export const Hyperlink = ({

EVENT.EXCALIDRAW_LINK,

event.nativeEvent,

);

onLinkOpen(element, customEvent);

onLinkOpen(

{

…element,

link: normalizeLink(element.link),

},

customEvent,

);

if (customEvent.defaultPrevented) {

event.preventDefault();

}

Expand Down Expand Up

@@ -231,21 +238,6 @@ const getCoordsForPopover = (

return { x, y };

};

export const normalizeLink = (link: string) => {

link = link.trim();

if (link) {

// prefix with protocol if not fully-qualified

if (!link.includes(“://”) && !/^[[\\/]/.test(link)) {

link = `https://${link}`;

}

}

return link;

};

export const isLocalLink = (link: string | null) => {

return !!(link?.includes(location.origin) || link?.startsWith(“/”));

};

export const actionLink = register({

name: "hyperlink",

perform: (elements, appState) => {

Expand Down