Trustarc - added integration scripts to top of head#2285
Trustarc - added integration scripts to top of head#2285gabrielvigil-mixpanel wants to merge 21 commits intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| "nx-flex nx-items-center nx-px-2 nx-py-1 nx-text-xs nx-font-semibold nx-text-purple140 nx-shadow-sm focus-visible:nx-outline focus-visible:nx-outline-2 focus-visible:nx-outline-offset-2 focus-visible:nx-outline-purple140"; | ||
|
|
||
| function getLoomShareURL(embedURL: string): string | null { | ||
| if (!embedURL.includes("loom.com")) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
In general, the fix is to stop using a substring check on the entire URL string and instead parse the URL, then verify that its hostname is an expected Loom host (for example loom.com or www.loom.com) before transforming it. This prevents URLs from other domains that merely contain loom.com somewhere in the path or query from being mistaken for Loom URLs.
Concretely, in components/VideoButtonWithModal/VideoButtonWithModal.tsx, we should update getLoomShareURL to:
- Safely construct a
URLobject fromembedURL, catching any parsing errors and returningnullif parsing fails. - Check that
url.hostnameis exactly an allowed Loom host (e.g.'loom.com'or'www.loom.com'). - If the host is allowed, convert the path from
/embed/VIDEO_IDto/share/VIDEO_IDwithout doing a global string replace on the entire URL; instead, operate on thepathnameand then reconstruct the URL via theURLobject. - Return the full transformed URL string using
url.toString().
We only need to change the getLoomShareURL function; all imports stay as-is since URL is available globally in modern browsers/Node, and this is a React/TSX file which runs in such environments. The rest of the component logic remains the same.
| @@ -16,11 +16,25 @@ | ||
| "nx-flex nx-items-center nx-px-2 nx-py-1 nx-text-xs nx-font-semibold nx-text-purple140 nx-shadow-sm focus-visible:nx-outline focus-visible:nx-outline-2 focus-visible:nx-outline-offset-2 focus-visible:nx-outline-purple140"; | ||
|
|
||
| function getLoomShareURL(embedURL: string): string | null { | ||
| if (!embedURL.includes("loom.com")) { | ||
| try { | ||
| const url = new URL(embedURL); | ||
| const allowedHosts = new Set(["loom.com", "www.loom.com"]); | ||
|
|
||
| if (!allowedHosts.has(url.hostname)) { | ||
| return null; | ||
| } | ||
|
|
||
| // Convert loom.com/embed/VIDEO_ID to loom.com/share/VIDEO_ID | ||
| if (url.pathname.startsWith("/embed/")) { | ||
| url.pathname = url.pathname.replace("/embed/", "/share/"); | ||
| return url.toString(); | ||
| } | ||
|
|
||
| return null; | ||
| } catch { | ||
| // If the URL is invalid, treat it as non-Loom | ||
| return null; | ||
| } | ||
| // Convert loom.com/embed/VIDEO_ID to loom.com/share/VIDEO_ID | ||
| return embedURL.replace("/embed/", "/share/"); | ||
| } | ||
|
|
||
| export default function VideoButtonWithModal({ |
2 participants
https://www.notion.so/mxpnl/Trustarc-Release-Doc-Runbook-30de0ba9256280e2a57bd7beeaaba338