Don't insert non-HTTP links to extension origin

df8e0ba9234715d5d274613cbef909c22a2632c5

Cohee <18619528+Cohee1207@users.noreply.github.com>

public/scripts/extensions.js+12 -4 Viewed

             try {
                 const data = await getExtensionVersion(externalId, abortSignal);
                 const extensionBlock = document.querySelector(`.extension_block[data-name="${externalId}"]`);
                 if (extensionBlock && data) {
                     if (data.isUpToDate === false) {
                         const buttonElement = extensionBlock.querySelector('.btn_update');
                         if (buttonElement) {

                     const originLink = extensionBlock.querySelector('a');
                     if (originLink) {
 -                        originLink.href = origin;
 +                        try {
 -                        originLink.target = '_blank';
 +                            const url = new URL(origin);
 -                        originLink.rel = 'noopener noreferrer';
 +                            if (!['https:', 'http:'].includes(url.protocol)) {
 +                                throw new Error('Invalid protocol');
 +                            }
 +                            originLink.href = url.href;
 +                            originLink.target = '_blank';
 +                            originLink.rel = 'noopener noreferrer';
 +                        } catch (error) {
 +                            console.log('Error setting origin link', originLink, error);
 +                        }
+                    }
                     const versionElement = extensionBlock.querySelector('.extension_version');