Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add allowed protocol list for file attachment #4143

Merged
merged 4 commits into from
Mar 2, 2022

Conversation

compulim
Copy link
Contributor

@compulim compulim commented Feb 15, 2022

Fixes #4142.

Changelog Entry

Added

  • Adds allowed protocol list to file attachment and OAuth card, by @compulim, in PR #4143

Description

Added allowed protocol list for file attachment and OAuth card.

Design

When a URL with protocol not on the allowlist, the file attachment UI will no longer render it as downloadable. OAuth card UI should not navigate to the link and should close the popup immediately.

We did not add blob: to the allowlist as it is not allowed today, see the code here for details.

Specific Changes

  • Added allowed protocol list to <FileContent> with http:, https:, and data:
  • Added allowed protocol list to card action middleware, which handle the OAuth card sign-in button, with http: and https:
  • I have added tests and executed them locally
  • I have updated CHANGELOG.md
  • I have updated documentation

Review Checklist

This section is for contributors to review your work.

  • Accessibility reviewed (tab order, content readability, alt text, color contrast)
  • Browser and platform compatibilities reviewed
  • CSS styles reviewed (minimal rules, no z-index)
  • Documents reviewed (docs, samples, live demo)
  • Internationalization reviewed (strings, unit formatting)
  • package.json and package-lock.json reviewed
  • Security reviewed (no data URIs, check for nonce leak)
  • Tests reviewed (coverage, legitimacy)

@compulim compulim added the p0 Must Fix. Release-blocker label Mar 1, 2022
@compulim compulim force-pushed the feat-allowed-protocol branch from e2f7202 to fe04d9c Compare March 1, 2022 05:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
p0 Must Fix. Release-blocker
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add allowed protocol list to file attachment
2 participants