Allowlist all stripe requests, not just stripe elements (#2175)

* Allowlist all stripe requests, not just stripe elements * Add stripecdn urls and tests
kickstarter · Oct 16, 2024 · 67ad9e8 · 67ad9e8
1 parent 0089505
commit 67ad9e8
Show file tree

Hide file tree

Showing 2 changed files with 60 additions and 3 deletions.
diff --git a/Library/ViewModels/SurveyResponseViewModel.swift b/Library/ViewModels/SurveyResponseViewModel.swift
@@ -107,7 +107,7 @@ public final class SurveyResponseViewModel: SurveyResponseViewModelType {
 
     self.policyDecisionProperty <~ newRequest
       .map { request in
-        if isStripeElement(request) {
+        if isStripeRequest(request) {
           return true
         }
 
@@ -164,6 +164,11 @@ private func isSurvey(request: URLRequest) -> Bool {
   return true
 }
 
-private func isStripeElement(_ request: URLRequest) -> Bool {
-  return request.url?.host == "js.stripe.com"
+// Returns true if the url host is of the form *.stripe.com, *.stripe.network, or *.stripecdn.com.
+private func isStripeRequest(_ request: URLRequest) -> Bool {
+  let stripeDomains = ["stripe.com", "stripe.network", "stripecdn.com"]
+
+  guard let host = request.url?.host?.lowercased() else { return false }
+  let withoutSubdomain = host.split(separator: ".").suffix(2).joined(separator: ".")
+  return stripeDomains.contains(withoutSubdomain)
 }
diff --git a/Library/ViewModels/SurveyResponseViewModelTests.swift b/Library/ViewModels/SurveyResponseViewModelTests.swift
@@ -205,10 +205,62 @@ final class SurveyResponseViewModelTests: TestCase {
       XCTAssertEqual(update, updateResult, " Update is wrong.")
     }
   }
+
+  // MARK: - Decision policy tests
+
+  func testBadRequest() {
+    let navigationData = navigationData("https://www.fake.com/bad-url")
+    XCTAssertEqual(
+      self.vm.decidePolicyFor(navigationAction: navigationData),
+      WKNavigationActionPolicy.cancel
+    )
+  }
+
+  func testBadStripeRequest() {
+    let navigationData = navigationData("https://www.stripecdn.network")
+    XCTAssertEqual(
+      self.vm.decidePolicyFor(navigationAction: navigationData),
+      WKNavigationActionPolicy.cancel
+    )
+  }
+
+  func testStripeNetworkRequest() {
+    let navigationData = navigationData("https://m.stripe.network/inner.html#url=fake")
+    XCTAssertEqual(
+      self.vm.decidePolicyFor(navigationAction: navigationData),
+      WKNavigationActionPolicy.allow
+    )
+  }
+
+  func testStripeElementRequest() {
+    let navigationData = navigationData("https://js.stripe.com/v3/controller-fake.html")
+    XCTAssertEqual(
+      self.vm.decidePolicyFor(navigationAction: navigationData),
+      WKNavigationActionPolicy.allow
+    )
+  }
+
+  func testStripeCdnRequest() {
+    let navigationData = navigationData("https://b.stripecdn.com/assets/v21.19/Captcha.html")
+    XCTAssertEqual(
+      self.vm.decidePolicyFor(navigationAction: navigationData),
+      WKNavigationActionPolicy.allow
+    )
+  }
 }
 
 // MARK: - Helpers
 
+private func navigationData(_ url: String) -> WKNavigationActionData {
+  let request = URLRequest(url: URL.init(string: url)!)
+  return WKNavigationActionData(
+    navigationType: .other,
+    request: request,
+    sourceFrame: WKFrameInfoData(frameInfo: WKFrameInfo()),
+    targetFrame: nil
+  )
+}
+
 private func surveyRequest(project: Project, prepared: Bool, method: KsApi.Method) -> URLRequest {
   let url = "\(project.urls.web.project)/surveys/1"
   var request = URLRequest(url: URL(string: url)!)