Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

♻️🐛 [Trusted Types] Make createExtensionScript's policy regex less permissive #39273

Merged
merged 3 commits into from
Jul 31, 2023
Merged

♻️🐛 [Trusted Types] Make createExtensionScript's policy regex less permissive #39273

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7cc3f61
make regex more strict
youssef-attia Jul 17, 2023
5563491
lint
youssef-attia Jul 17, 2023
5d16031
Merge branch 'ampproject:main' into tt_extension_script_fix
youssef-attia Jul 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 5 additions & 7 deletions src/service/extension-script.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,9 @@ import {getMode} from '../mode';
const CUSTOM_TEMPLATES = ['amp-mustache'];
const LATEST_VERSION = 'latest';

const cdnRegexUrl = new RegExp(
// eslint-disable-next-line local/no-forbidden-terms
'^https://([a-zA-Z0-9_-]+.)?cdn.ampproject.org(/.*)?$'
);
const testCdnRegexUrl = new RegExp('^([a-zA-Z0-9_-]+.)?localhost$');
const regexURL =
/^https:\/\/([a-zA-Z0-9_-]+\.)?cdn\.ampproject\.org(\/.*)?$/;
const testRegexURL = /^([a-zA-Z0-9_-]+\.)?localhost$/;

/**
* Calculate the base url for any scripts.
Expand Down Expand Up @@ -166,8 +164,8 @@ export function createExtensionScript(win, extensionId, version) {
createScriptURL: function (url) {
// Only allow trusted URLs
if (
cdnRegexUrl.test(url) ||
(getMode().test && testCdnRegexUrl.test(new URL(url).hostname)) ||
regexURL.test(url) ||
(getMode().test && testRegexURL.test(new URL(url).hostname)) ||
new URL(url).host === 'fonts.googleapis.com'
) {
return url;
Expand Down