fix: validate identity.url scheme before rendering as external link - #644
Merged
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
Addresses a security issue where an ENS-supplied identity.url could be rendered directly into an external link without validation.
Changes:
- Added
sanitizeExternalUrlutility to validate/normalize user-supplied URLs to safehttp(s)absolute URLs. - Updated the profile page to use the sanitized URL (or skip rendering the link when invalid).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
lib/utils.tsx |
Adds sanitizeExternalUrl for scheme normalization and protocol validation. |
components/Profile/index.tsx |
Uses sanitizeExternalUrl(identity?.url) before rendering an external website link. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
rickstaa
force-pushed
the
fix/profile-url-href-validation
branch
from
April 29, 2026 10:47
3b84d27 to
249bc08
Compare
Orchestrator profile URLs come from ENS text records — a user-controlled field. As rendered, values like `javascript:alert(...)`, `data:...`, or schemeless `evil.com/path` (treated as a relative URL) would all become clickable from the profile page. React 16+ warns on `javascript:` hrefs but doesn't reliably block them. Add `sanitizeExternalUrl` in `lib/utils.tsx` that auto-prefixes `https://` for schemeless input, parses via `new URL(...)`, and rejects anything outside `http:` / `https:`. Use the sanitized value for both `href` and the displayed text; suppress the entire link block when sanitization fails. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ECWireless
force-pushed
the
fix/profile-url-href-validation
branch
from
September 20, 2026 22:44
249bc08 to
5dddb15
Compare
ECWireless
approved these changes
Sep 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #643
Summary
Sanitizes the ENS-supplied
identity.urlvalue before rendering it as an external link in the orchestrator profile header. AddssanitizeExternalUrltolib/utils.tsxand uses it for bothhrefand the displayed text.Why
identity.urlis set by the orchestrator via their ENSurltext record — fully user-controlled. Without validation, values likejavascript:alert(...),data:text/html,..., or schemelessevil.com/path(which resolves as a relative link to explorer.livepeer.org) are rendered verbatim into the DOM. React 16+ warns onjavascript:hrefs but does not reliably block them.What changed
sanitizeExternalUrl(url)helper tolib/utils.tsx. It auto-prefixeshttps://for schemeless input, parses vianew URL(...), returns the canonical form on success, ornullfor anything that fails to parse or uses a non-http(s) protocol.components/Profile/index.tsx, computesafeIdentityUrlonce at the top of the component and use it for the link'shref,title, and the visible text. Suppress the entire link block when sanitization fails.https://twitter.com//https://github.com/URLs and are not the same risk.Test plan
pnpm typecheckpasses (via pre-commit hook).pnpm lintandprettier --checkpass.http(s)URL — link still works as before.javascript:URL doesn't render the link block at all.🤖 Generated with Claude Code