Files
twenty/packages/twenty-shared/src/utils/index.ts
T
Félix Malfait 8da69e0f77 Fix stored XSS via unsafe URL protocols in href attributes (#19282)
## Summary

- Fixes **GHSA-7w89-7q26-gj7q**: stored XSS via `javascript:` URIs in
BlockNote `FileBlock` `props.url`, rendered as a clickable `<a href>`.
- Audited the full codebase and hardened **all** surfaces where
user-controlled URLs are rendered as `href` or passed to `window.open`.
- Applies defense-in-depth: server-side input validation + client-side
render-time checks + lint rules to prevent regressions.

### Changes

**New utility** — `isSafeUrl` (`~/utils/isSafeUrl.ts`):  
Allowlists `http:`, `https:`, `mailto:`, `tel:` protocols and relative
paths (`/`). Returns `false` for `javascript:`, `data:`, `vbscript:`,
etc.

**Server-side** — `validateBlocknoteFieldOrThrow`:  
- Recursively walks all blocks and validates `props.url` and inline link
`href` values
- Rejects payloads with unsafe URL protocols at save time (before data
is stored)

**Client-side** — 8 components hardened:
| Component | Fix |
|-----------|-----|
| `FileBlock` (reported vuln) | `isSafeUrl` gate, fixed
`target="__blank"` → `_blank`, added `rel="noopener noreferrer"` |
| `LazyMarkdownRenderer` | `isSafeUrl` gate on markdown `<a href>`,
added `target`/`rel` |
| `EditLinkPopover` (TipTap) | Validates + auto-prefixes `https://`,
rejects unsafe URLs |
| `LinkBubbleMenu` (TipTap) | `isSafeUrl` gate on `window.open`, added
`noopener,noreferrer` |
| `AttachmentRow` | `isSafeUrl` gate on file attachment `href` |
| `URLDisplay` / `LinkDisplay` | `isSafeUrl` as second check after
`startsWith('http')` |
| `IframeWidget` | `isSafeUrl` gate on `src`, shows error state for
unsafe URLs |
| `InformationBannerMaintenance` | `isSafeUrl` gate on `window.open` |

**Lint rules** — `.oxlintrc.json`:
- `no-script-url: error` — catches `javascript:` string literals
- `react/jsx-no-script-url: error` — catches `javascript:` in JSX href
attributes

## Test plan

- [ ] Create a note via GraphQL mutation with `"url":
"javascript:void(alert(1))"` in a file block — should be rejected by
server validation
- [ ] Verify existing file attachments in notes still render and are
clickable
- [ ] Verify TipTap link insertion works for normal `https://` URLs
- [ ] Verify TipTap link insertion rejects `javascript:` URIs
- [ ] Verify markdown links in AI chat render correctly for safe URLs
- [ ] Verify URL/Link field displays still work for normal URLs
- [ ] Verify iframe widget rejects non-http(s) URLs


Made with [Cursor](https://cursor.com)

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-04 08:05:27 +02:00

219 lines
15 KiB
TypeScript

/*
* _____ _
*|_ _|_ _____ _ __ | |_ _ _
* | | \ \ /\ / / _ \ '_ \| __| | | | Auto-generated file
* | | \ V V / __/ | | | |_| |_| | Any edits to this will be overridden
* |_| \_/\_/ \___|_| |_|\__|\__, |
* |___/
*/
export { applyDiff } from './applyDiff';
export { compareArraysOfObjectsByProperty } from './array/compareArraysOfObjectsByProperty';
export { filterDuplicatesById } from './array/filterDuplicatesById';
export { filterOutByProperty } from './array/filterOutByProperty';
export { findById } from './array/findById';
export { findByProperty } from './array/findByProperty';
export { findOrThrow } from './array/findOrThrow';
export { getContiguousIncrementalValues } from './array/getContiguousIncrementalValues';
export { isNonEmptyArray } from './array/isNonEmptyArray';
export { mapById } from './array/mapById';
export { mapByProperty } from './array/mapByProperty';
export { sumByProperty } from './array/sumByProperty';
export { upsertIntoArrayOfObjectsComparingId } from './array/upsertIntoArrayOfObjectsComparingId';
export { upsertPropertiesOfItemIntoArrayOfObjectsComparingId } from './array/upsertPropertiesOfItemIntoArrayOfObjectsComparingId';
export { assertUnreachable } from './assertUnreachable';
export { base64UrlEncode } from './base64UrlEncode';
export { conditionalAvailabilityParser } from './command-menu-items/conditionalAvailabilityParser';
export { evaluateConditionalAvailabilityExpression } from './command-menu-items/evaluateConditionalAvailabilityExpression';
export { interpolateCommandMenuItemTemplate } from './command-menu-items/interpolateCommandMenuItemTemplate';
export { resolveObjectMetadataLabel } from './command-menu-items/resolveObjectMetadataLabel';
export { safeGetNestedProperty } from './command-menu-items/safeGetNestedProperty';
export { computeDiffBetweenObjects } from './compute-diff-between-objects';
export { isPlainDateAfter } from './date/isPlainDateAfter';
export { isPlainDateBefore } from './date/isPlainDateBefore';
export { isPlainDateBeforeOrEqual } from './date/isPlainDateBeforeOrEqual';
export { isPlainDateInSameMonth } from './date/isPlainDateInSameMonth';
export { isPlainDateInWeekend } from './date/isPlainDateInWeekend';
export { isSamePlainDate } from './date/isSamePlainDate';
export { parseToPlainDateOrThrow } from './date/parseToPlainDateOrThrow';
export { sortPlainDate } from './date/sortPlainDate';
export { turnJSDateToPlainDate } from './date/turnJSDateToPlainDate';
export { turnPlainDateIntoUserTimeZoneInstantString } from './date/turnPlainDateIntoUserTimeZoneInstantString';
export { turnPlainDateToShiftedDateInSystemTimeZone } from './date/turnPlainDateToShiftedDateInSystemTimeZone';
export { deepMerge } from './deepMerge';
export { CustomError } from './errors/CustomError';
export { evalFromContext } from './evalFromContext';
export { extractAndSanitizeObjectStringFields } from './extractAndSanitizeObjectStringFields';
export { computeMorphRelationFieldName } from './fieldMetadata/compute-morph-relation-field-name';
export { isFieldMetadataArrayKind } from './fieldMetadata/isFieldMetadataArrayKind';
export { isFieldMetadataDateKind } from './fieldMetadata/isFieldMetadataDateKind';
export { isFieldMetadataEligibleForFieldsWidget } from './fieldMetadata/isFieldMetadataEligibleForFieldsWidget';
export { isFieldMetadataNumericKind } from './fieldMetadata/isFieldMetadataNumericKind';
export { isFieldMetadataSelectKind } from './fieldMetadata/isFieldMetadataSelectKind';
export { isFieldMetadataTextKind } from './fieldMetadata/isFieldMetadataTextKind';
export { extractFolderPathFilenameAndTypeOrThrow } from './files/extractFolderPathFilenameAndTypeOrThrow.util';
export { checkIfShouldComputeEmptinessFilter } from './filter/checkIfShouldComputeEmptinessFilter';
export { computeGqlOperationFilterForEmails } from './filter/compute-record-gql-operation-filter/for-composite-field/computeGqlOperationFilterForEmails';
export { computeGqlOperationFilterForLinks } from './filter/compute-record-gql-operation-filter/for-composite-field/computeGqlOperationFilterForLinks';
export { computeEmptyGqlOperationFilterForEmails } from './filter/computeEmptyGqlOperationFilterForEmails';
export { computeEmptyGqlOperationFilterForLinks } from './filter/computeEmptyGqlOperationFilterForLinks';
export { computeRecordGqlOperationFilter } from './filter/computeRecordGqlOperationFilter';
export type { DateTimePeriod } from './filter/dates/types/DateTimePeriod';
export { addUnitToDateTime } from './filter/dates/utils/addUnitToDateTime';
export { addUnitToZonedDateTime } from './filter/dates/utils/addUnitToZonedDateTime';
export { convertCalendarStartDayNonIsoNumberToFirstDayOfTheWeek } from './filter/dates/utils/convertCalendarStartDayNonIsoNumberToFirstDayOfTheWeek';
export { convertFirstDayOfTheWeekToCalendarStartDayNumber } from './filter/dates/utils/convertFirstDayOfTheWeekToCalendarStartDayNumber';
export type { FirstDayOfTheWeekSchema } from './filter/dates/utils/firstDayOfWeekSchema';
export { firstDayOfWeekSchema } from './filter/dates/utils/firstDayOfWeekSchema';
export { getFirstDayOfTheWeekAsANumberForDateFNS } from './filter/dates/utils/getFirstDayOfTheWeekAsANumberForDateFNS';
export { getFirstDayOfTheWeekAsISONumber } from './filter/dates/utils/getFirstDayOfTheWeekAsISONumber';
export {
FIRST_DAY_OF_WEEK_ISO_8601_MONDAY,
getNextPeriodStart,
} from './filter/dates/utils/getNextPeriodStart';
export { getPeriodStart } from './filter/dates/utils/getPeriodStart';
export { relativeDateFilterAmountSchema } from './filter/dates/utils/relativeDateFilterAmountSchema';
export type { RelativeDateFilterDirection } from './filter/dates/utils/relativeDateFilterDirectionSchema';
export { relativeDateFilterDirectionSchema } from './filter/dates/utils/relativeDateFilterDirectionSchema';
export type { RelativeDateFilter } from './filter/dates/utils/relativeDateFilterSchema';
export { relativeDateFilterSchema } from './filter/dates/utils/relativeDateFilterSchema';
export { relativeDateFilterStringifiedSchema } from './filter/dates/utils/relativeDateFilterStringifiedSchema';
export type { RelativeDateFilterUnit } from './filter/dates/utils/relativeDateFilterUnitSchema';
export { relativeDateFilterUnitSchema } from './filter/dates/utils/relativeDateFilterUnitSchema';
export type { ResolvedDateFilterValue } from './filter/dates/utils/resolveDateFilter';
export { resolveDateFilter } from './filter/dates/utils/resolveDateFilter';
export type { ResolvedDateTimeFilterValue } from './filter/dates/utils/resolveDateTimeFilter';
export { resolveDateTimeFilter } from './filter/dates/utils/resolveDateTimeFilter';
export { resolveRelativeDateFilter } from './filter/dates/utils/resolveRelativeDateFilter';
export { resolveRelativeDateFilterStringified } from './filter/dates/utils/resolveRelativeDateFilterStringified';
export { resolveRelativeDateTimeFilter } from './filter/dates/utils/resolveRelativeDateTimeFilter';
export { resolveRelativeDateTimeFilterStringified } from './filter/dates/utils/resolveRelativeDateTimeFilterStringified';
export { subUnitFromDateTime } from './filter/dates/utils/subUnitFromDateTime';
export { subUnitFromZonedDateTime } from './filter/dates/utils/subUnitFromZonedDateTime';
export { filterOutInvalidRecordFilters } from './filter/filterOutInvalidRecordFilters';
export { isEmptinessOperand } from './filter/isEmptinessOperand';
export { isRecordFilterOperandExpectingValue } from './filter/isRecordFilterOperandExpectingValue';
export { isRecordFilterValueValid } from './filter/isRecordFilterValueValid';
export { turnAnyFieldFilterIntoRecordGqlFilter } from './filter/turnAnyFieldFilterIntoRecordGqlFilter';
export type {
RecordFilter,
RecordFilterGroup,
} from './filter/turnRecordFilterGroupIntoGqlOperationFilter';
export { turnRecordFilterGroupsIntoGqlOperationFilter } from './filter/turnRecordFilterGroupIntoGqlOperationFilter';
export { turnRecordFilterIntoRecordGqlOperationFilter } from './filter/turnRecordFilterIntoGqlOperationFilter';
export { combineFilters } from './filter/utils/combineFilters';
export { convertViewFilterOperandToCoreOperand } from './filter/utils/convert-view-filter-operand-to-core-operand.util';
export { convertViewFilterValueToString } from './filter/utils/convertViewFilterValueToString';
export { createAnyFieldRecordFilterBaseProperties } from './filter/utils/createAnyFieldRecordFilterBaseProperties';
export {
convertGreaterThanOrEqualRatingToArrayOfRatingValues,
convertLessThanOrEqualRatingToArrayOfRatingValues,
convertRatingToRatingValue,
} from './filter/utils/fieldRatingConvertors';
export { filterSelectOptionsOfFieldMetadataItem } from './filter/utils/filterSelectOptionsOfFieldMetadataItem';
export { generateILikeFiltersForCompositeFields } from './filter/utils/generateILikeFiltersForCompositeFields';
export { getEmptyRecordGqlOperationFilter } from './filter/utils/getEmptyRecordGqlOperationFilter';
export { getFilterTypeFromFieldType } from './filter/utils/getFilterTypeFromFieldType';
export { isExpectedSubFieldName } from './filter/utils/isExpectedSubFieldName';
export { isMatchingArrayFilter } from './filter/utils/isMatchingArrayFilter';
export { isMatchingBooleanFilter } from './filter/utils/isMatchingBooleanFilter';
export { isMatchingCurrencyFilter } from './filter/utils/isMatchingCurrencyFilter';
export { isMatchingDateFilter } from './filter/utils/isMatchingDateFilter';
export { isMatchingFilesFilter } from './filter/utils/isMatchingFilesFilter';
export { isMatchingFloatFilter } from './filter/utils/isMatchingFloatFilter';
export { isMatchingMultiSelectFilter } from './filter/utils/isMatchingMultiSelectFilter';
export { isMatchingRatingFilter } from './filter/utils/isMatchingRatingFilter';
export { isMatchingRawJsonFilter } from './filter/utils/isMatchingRawJsonFilter';
export { isMatchingRichTextFilter } from './filter/utils/isMatchingRichTextFilter';
export { isMatchingSelectFilter } from './filter/utils/isMatchingSelectFilter';
export { isMatchingStringFilter } from './filter/utils/isMatchingStringFilter';
export { isMatchingTSVectorFilter } from './filter/utils/isMatchingTSVectorFilter';
export { isMatchingUUIDFilter } from './filter/utils/isMatchingUUIDFilter';
export { arrayOfStringsOrVariablesSchema } from './filter/utils/validation-schemas/arrayOfStringsOrVariablesSchema';
export { arrayOfUuidOrVariableSchema } from './filter/utils/validation-schemas/arrayOfUuidsOrVariablesSchema';
export {
relationFilterValueSchemaObject,
jsonRelationFilterValueSchema,
} from './filter/utils/validation-schemas/jsonRelationFilterValueSchema';
export { formatToShortNumber } from './format/formatToShortNumber';
export { fromArrayToUniqueKeyRecord } from './from-array-to-unique-key-record.util';
export { fromArrayToValuesByKeyRecord } from './fromArrayToValuesByKeyRecord.util';
export { getURLSafely } from './getURLSafely';
export {
getNodeTypename,
getConnectionTypename,
getEdgeTypename,
getGroupByConnectionTypename,
} from './graphql/graphql-get-typename.util';
export { getImageAbsoluteURI } from './image/getImageAbsoluteURI';
export {
sanitizeURL,
getLogoUrlFromDomainName,
} from './image/getLogoUrlFromDomainName';
export { getUniqueConstraintsFields } from './indexMetadata/getUniqueConstraintsFields';
export { isAutoSelectModelId } from './isAutoSelectModelId';
export { fastDeepEqual } from './json/fast-deep-equal';
export { getAppPath } from './navigation/getAppPath';
export { getSettingsPath } from './navigation/getSettingsPath';
export { parseJson } from './parseJson';
export { removePropertiesFromRecord } from './removePropertiesFromRecord';
export { removeUndefinedFields } from './removeUndefinedFields';
export { resolveRichTextVariables } from './rich-text-variable-resolver';
export { safeParseRelativeDateFilterJSONStringified } from './safeParseRelativeDateFilterJSONStringified';
export { getGenericOperationName } from './sentry/getGenericOperationName';
export { getHumanReadableNameFromCode } from './sentry/getHumanReadableNameFromCode';
export { appendCopySuffix } from './strings/appendCopySuffix';
export { camelToKebab } from './strings/camelToKebab';
export { camelToSnakeCase } from './strings/camelToSnakeCase';
export { capitalize } from './strings/capitalize';
export { kebabToCamelCase } from './strings/kebabToCamelCase';
export { pascalCase } from './strings/pascalCase';
export { pascalToKebab } from './strings/pascalToKebab';
export { stringifySafely } from './strings/stringifySafely';
export { uncapitalize } from './strings/uncapitalize';
export type {
TipTapMarkType,
TipTapNodeType,
LinkMarkAttributes,
TipTapMark,
} from './tiptap/tiptap-marks';
export {
TIPTAP_MARK_TYPES,
TIPTAP_NODE_TYPES,
TIPTAP_MARKS_RENDER_ORDER,
} from './tiptap/tiptap-marks';
export type { StringPropertyKeys } from './trim-and-remove-duplicated-whitespaces-from-object-string-properties';
export { trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties } from './trim-and-remove-duplicated-whitespaces-from-object-string-properties';
export { trimAndRemoveDuplicatedWhitespacesFromString } from './trim-and-remove-duplicated-whitespaces-from-string';
export { isMetadataGqlOperationSignature } from './typeguard/isMetadataGqlOperationSignature';
export { isPlainObject } from './typeguard/isPlainObject';
export { isRecordGqlOperationSignature } from './typeguard/isRecordGqlOperationSignature';
export { throwIfNotDefined } from './typeguard/throwIfNotDefined';
export { absoluteUrlSchema } from './url/absoluteUrlSchema';
export { buildSignedPath } from './url/buildSignedPath';
export { ensureAbsoluteUrl } from './url/ensureAbsoluteUrl';
export { getAbsoluteUrlOrThrow } from './url/getAbsoluteUrlOrThrow';
export { getSafeUrl } from './url/getSafeUrl';
export { getUrlHostnameOrThrow } from './url/getUrlHostnameOrThrow';
export { isSafeUrl } from './url/isSafeUrl';
export { isValidHostname } from './url/isValidHostname';
export { isValidUrl } from './url/isValidUrl';
export { normalizeUrl } from './url/normalizeUrl';
export { normalizeUrlOrigin } from './url/normalizeUrlOrigin';
export { safeDecodeURIComponent } from './url/safeDecodeURIComponent';
export { uuidToBase36 } from './uuidToBase36';
export { assertIsDefinedOrThrow } from './validation/assertIsDefinedOrThrow';
export { isDefined } from './validation/isDefined';
export { isEmptyObject } from './validation/isEmptyObject';
export { isLabelIdentifierFieldMetadataTypes } from './validation/isLabelIdentifierFieldMetadataTypes';
export type { SearchableFieldType } from './validation/isSearchableFieldType';
export { isSearchableFieldType } from './validation/isSearchableFieldType';
export { isValidLocale } from './validation/isValidLocale';
export { isValidTwentySubdomain } from './validation/isValidTwentySubdomain';
export { isValidUuid } from './validation/isValidUuid';
export { isValidVariable } from './validation/isValidVariable';
export { normalizeLocale } from './validation/normalizeLocale';
export { getCountryCodesForCallingCode } from './validation/phones-value/getCountryCodesForCallingCode';
export { isValidCountryCode } from './validation/phones-value/isValidCountryCode';
export { resolveInput } from './variable-resolver';