Repository navigation
Conversation
Validate webhook target URLs with the URL constructor so only valid https:// endpoints (and loopback http://localhost, http://127.0.0.1, http://[::1] for local testing) are accepted. Display an inline error alert when a plain http:// or malformed URL is entered and keep the Save button disabled. Fixes LabsCrypt#1634
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Enforces explicit client-side URL parsing and HTTPS protocol validation in
WebhookModal(frontend/src/components/webhooks/WebhookModal.tsx) so invalid or insecure non-loopbackhttp://URLs are caught immediately in the form before submitting to the backend.Type of Change
Related Issues
Closes #1634
Fixes #1634
/claim #1634
Changes Made
validateWebhookUrl(rawUrl)infrontend/src/components/webhooks/WebhookModal.tsxusingnew URL()to validate that the input is a well-formed URL with a non-empty hostname and no embedded whitespace.https:protocol for remote webhook endpoints while permitting loopbackhttp://localhost,http://127.0.0.1, andhttp://[::1]for local development testing.id="webhook-url-error",role="alert", wired viaaria-invalidandaria-describedbyon#webhook-url) below the URL input when an invalid or non-loopbackhttp://URL is entered.validUrlisfalseand trimmedtargetUrlon submission.frontend/src/components/webhooks/WebhookModal.test.tsx.Testing
Test Coverage
Test Steps
npx vitest run src/components/webhooks/WebhookModal.test.tsx src/components/webhooks/WebhookTable.test.tsxinfrontend/(18/18 tests pass).npx tsc --noEmitinfrontend/(0 errors).npx eslint src/components/webhooks/WebhookModal.tsx src/components/webhooks/WebhookModal.test.tsxinfrontend/(0 errors).Checklist
Additional Notes
Payout Details
0x9a51790aC01c54184bcFa067bC38f7F0E7C6F6B6