etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-28 09:33:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ConnectionModal.tsx

Browse Source
This commit is contained in:
Egor
2026-01-19 22:36:44 +03:00
committed by GitHub
parent 164ec7a380
commit 1e7b6d2f36
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/components/ConnectionModal.tsx
View File

@@ -61,12 +61,8 @@ const platformIconComponents: Record<string, React.FC> = {
// Platform order for display // Platform order for display
const platformOrder = ['ios', 'android', 'windows', 'macos', 'linux', 'androidTV', 'appleTV'] const platformOrder = ['ios', 'android', 'windows', 'macos', 'linux', 'androidTV', 'appleTV']
// Allowed app schemes for deep links // Dangerous schemes that should never be allowed
const allowedAppSchemes = [ const dangerousSchemes = ['javascript:', 'data:', 'vbscript:', 'file:']
'happ://', 'flclash://', 'clash://', 'sing-box://', 'v2rayng://',
'sub://', 'shadowrocket://', 'hiddify://', 'streisand://',
'quantumult://', 'surge://', 'loon://', 'nekobox://', 'v2box://'
]
/** /**
* Validate URL to prevent XSS via javascript: and other dangerous schemes * Validate URL to prevent XSS via javascript: and other dangerous schemes
@@ -87,20 +83,20 @@ function isValidExternalUrl(url: string | undefined): boolean {
} }
/** /**
* Validate deep link URL - only allows known VPN app schemes * Validate deep link URL - blocks dangerous schemes only
* Allows any custom app scheme (clash://, hiddify://, etc.)
*/ */
function isValidDeepLink(url: string | undefined): boolean { function isValidDeepLink(url: string | undefined): boolean {
if (!url) return false if (!url) return false
const lowerUrl = url.toLowerCase().trim() const lowerUrl = url.toLowerCase().trim()
// Block dangerous schemes // Block dangerous schemes
const dangerousSchemes = ['javascript:', 'data:', 'vbscript:', 'file:']
if (dangerousSchemes.some(scheme => lowerUrl.startsWith(scheme))) { if (dangerousSchemes.some(scheme => lowerUrl.startsWith(scheme))) {
return false return false
} }
// Allow known app schemes // Allow any URL that has a scheme (contains ://)
return allowedAppSchemes.some(scheme => lowerUrl.startsWith(scheme)) return lowerUrl.includes('://')
} }
// Detect user's platform from user agent // Detect user's platform from user agent