Don't insert non-HTTP links to extension origin

df8e0ba9234715d5d274613cbef909c22a2632c5

Cohee <18619528+Cohee1207@users.noreply.github.com>

public/scripts/extensions.js+12 -4 Viewed

             try {
                 const data = await getExtensionVersion(externalId, abortSignal);
                 const extensionBlock = document.querySelector(`.extension_block[data-name="${externalId}"]`);
-                if (extensionBlock) {
+                if (extensionBlock && data) {
                     if (data.isUpToDate === false) {
                         const buttonElement = extensionBlock.querySelector('.btn_update');
                         if (buttonElement) {

                     const originLink = extensionBlock.querySelector('a');
                     if (originLink) {
-                        originLink.href = origin;
+                        try {
-                        originLink.target = '_blank';
+                            const url = new URL(origin);
-                        originLink.rel = 'noopener noreferrer';
+                            if (!['https:', 'http:'].includes(url.protocol)) {
+                                throw new Error('Invalid protocol');
+                            }
+                            originLink.href = url.href;
+                            originLink.target = '_blank';
+                            originLink.rel = 'noopener noreferrer';
+                        } catch (error) {
+                            console.log('Error setting origin link', originLink, error);
+                        }
+                    }
                     const versionElement = extensionBlock.querySelector('.extension_version');