Repository: oceanprotocol/market (ts)

Issue:
Cleanup the 'sanitizeUrl()' function in '/src/@utils/url.ts'
Instead of having a deny list of URIs, there should be an allow list.

Pull request:
tweak sanitizeUrl()
* closes #1622

Patch:
diff --git a/src/@utils/url.ts b/src/@utils/url.ts
index 5fbfe5f4..0ef9ea78 100644
--- a/src/@utils/url.ts
+++ b/src/@utils/url.ts
@@ -1,10 +1,5 @@
 export function sanitizeUrl(url: string) {
   const u = decodeURI(url).trim().toLowerCase()
-  if (
-    u.startsWith('javascript:') ||
-    u.startsWith('data:') ||
-    u.startsWith('vbscript:')
-  )
-    return 'about:blank'
-  return url
+  const isAllowedUrlScheme = u.startsWith('http://') || u.startsWith('https://')
+  return isAllowedUrlScheme ? url : 'about:blank'
 }


Test patch:
diff --git a/src/@utils/url.test.ts b/src/@utils/url.test.ts
new file mode 100644
index 00000000..20afffdb
--- /dev/null
+++ b/src/@utils/url.test.ts
@@ -0,0 +1,9 @@
+import { sanitizeUrl } from './url'
+
+describe('@utils/url', () => {
+  test('sanitizeUrl', () => {
+    expect(sanitizeUrl('http://example.com')).toBe('http://example.com')
+    expect(sanitizeUrl('https://example.com')).toBe('https://example.com')
+    expect(sanitizeUrl('ftp://example.com')).toBe('about:blank')
+  })
+})