fix(entity-link): more robust url regex

packages/entities/entities-shared/src/composables/tests/useExternalLinkCreator.spec.ts

@@ -1,4 +1,5 @@
-import { expect } from 'vitest'
+import { expect, vi } from 'vitest'
+import type { SpyInstance } from 'vitest'
 import composables from '..'
 
 const { useExternalLinkCreator } = composables
@@ -22,6 +23,12 @@ const routeParams = [
 ]
 
 describe('parse-route-parameters', () => {
+  let consoleMock: SpyInstance
+
+  beforeEach(() => {
+    consoleMock = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+  })
+
   it('builds valid url with multiple parameters', () => {
     const url = useExternalLinkCreator(routeParams)
 
@@ -39,5 +46,53 @@ describe('parse-route-parameters', () => {
 
     // Console error should be thrown, and method will return empty string
     expect(url).toBe('')
+    expect(consoleMock).toHaveBeenCalledOnce()
+    expect(consoleMock).toHaveBeenLastCalledWith('Failed to build valid URL:', new Error('Invalid url'))
+  })
+
+  it('fails if there are trailing slashes', () => {
+    const url = useExternalLinkCreator([routeParams[0], routeParams[1], '//'])
+
+    // Console error should be thrown, and method will return empty string
+    expect(url).toBe('')
+    expect(consoleMock).toHaveBeenLastCalledWith('Failed to build valid URL:', new Error('Invalid url'))
+  })
+
+  it('fails if the base URL uses http protocol', () => {
+    vi.spyOn(global as any, 'window', 'get').mockImplementationOnce(() => ({
+      location: {
+        origin: 'http://cloud.konghq.tech/',
+      },
+    }))
+
+    const url = useExternalLinkCreator([routeParams[0], routeParams[1]])
+
+    expect(url).toBe('')
+    expect(consoleMock).toHaveBeenLastCalledWith('Failed to build valid URL:', new Error('Invalid url'))
+  })
+
+  it('allows http only for localhost', () => {
+    vi.spyOn(global as any, 'window', 'get').mockImplementationOnce(() => ({
+      location: {
+        origin: 'http://localhost:3000/',
+      },
+    }))
+
+    const url = useExternalLinkCreator([routeParams[0], routeParams[1]])
+
+    expect(url).toBe(`http://localhost:3000/${routeParams[0]}/${routeParams[1]}`)
+  })
+
+  it('does not allow port number following an external domain', () => {
+    vi.spyOn(global as any, 'window', 'get').mockImplementationOnce(() => ({
+      location: {
+        origin: 'http://cloud.konghq.tech:3000/',
+      },
+    }))
+
+    const url = useExternalLinkCreator([routeParams[0]])
+
+    expect(url).toBe('')
+    expect(consoleMock).toHaveBeenLastCalledWith('Failed to build valid URL:', new Error('Invalid url'))
   })
 })

packages/entities/entities-shared/src/composables/useExternalLinkCreator.ts

@@ -7,11 +7,12 @@ export default function useExternalLinkCreator(routeParams: string[]): string {
     const fullUrl = `${baseUrl}${path}`
     const hasEmptyParams = routeParams.some(item => item.trim() === '')
 
-    /* Test validity of generated URL */
-    const urlRegex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,4}\b([-a-zA-Z0-9@:%_\+.~#?&//=]*)/g // eslint-disable-line no-useless-escape
+    // Test validity of generated URL; only allows `http` protocal if domain is `localhost`
+    /* eslint-disable-next-line no-useless-escape */
+    const validUrlRegex = /^(https:\/\/(www\.)?([a-zA-Z0-9-]+\.){1,}[a-zA-Z]{2,}(:[0-9]+)?(\/[^\/]+)*)$|^(https|http):\/\/localhost(:[0-9]+)?(\/[^\/]+)*$/
 
     /* eslint-disable no-new */
-    if (!urlRegex.test(fullUrl) && !hasEmptyParams && new URL(fullUrl)) {
+    if (validUrlRegex.test(fullUrl) && !hasEmptyParams && new URL(fullUrl)) {
       return `${baseUrl}${path}`
     } else {
       throw new Error('Invalid url')