Merge pull request #598 from byte1012/fix-#27080

Do not allow starting and ending hyphen in local-style urls
Expensify · Nov 9, 2023 · 5a8993b · 5a8993b
2 parents 0e96a8f + e9daa1c
commit 5a8993b
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/__tests__/URL-test.js b/__tests__/URL-test.js
@@ -48,12 +48,19 @@ describe('Loose URL validation', () => {
         expect(regexToTest.test('http://a.b')).toBeTruthy();
         expect(regexToTest.test('http://expensify')).toBeTruthy();
         expect(regexToTest.test('http://google.com/abcd')).toBeTruthy();
+        expect(regexToTest.test('http://my.localhost.local-domain')).toBeTruthy();
     });
 
     it('correctly tests invalid urls', () => {
         const regexToTest = new RegExp(`^${LOOSE_URL_REGEX}$`, 'i');
         expect(regexToTest.test('localhost:3000')).toBeFalsy();
         expect(regexToTest.test('local.url')).toBeFalsy();
         expect(regexToTest.test('https://otherexample.com links get rendered first')).toBeFalsy();
+        expect(regexToTest.test('http://-localhost')).toBeFalsy();
+        expect(regexToTest.test('http://_')).toBeFalsy();
+        expect(regexToTest.test('http://_localhost')).toBeFalsy();
+        expect(regexToTest.test('http://-77.com')).toBeFalsy();
+        expect(regexToTest.test('http://77-.com')).toBeFalsy();
+        expect(regexToTest.test('http://my.localhost....local-domain:8080')).toBeFalsy();
     });
 });
diff --git a/lib/Url.js b/lib/Url.js
@@ -11,7 +11,7 @@ const URL_REGEX = `((${URL_WEBSITE_REGEX})${URL_PATH_REGEX}(?:${URL_PARAM_REGEX}
 
 const URL_REGEX_WITH_REQUIRED_PROTOCOL = URL_REGEX.replace(`${URL_PROTOCOL_REGEX}?`, URL_PROTOCOL_REGEX);
 
-const LOOSE_URL_WEBSITE_REGEX = `${URL_PROTOCOL_REGEX}([-\\w]+(\\.[-\\w]+)*)(?:\\:${ALLOWED_PORTS}|\\b|(?=_))`;
+const LOOSE_URL_WEBSITE_REGEX = `${URL_PROTOCOL_REGEX}([a-z0-9](?:[-a-z0-9]*[a-z0-9])?\\.)*(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?)(?:\\:${ALLOWED_PORTS}|\\b|(?=_))`;
 const LOOSE_URL_REGEX = `((${LOOSE_URL_WEBSITE_REGEX})${URL_PATH_REGEX}(?:${URL_PARAM_REGEX}|${URL_FRAGMENT_REGEX})*)`;