From 1e7b6d2f36c31fdf35e288a45294f713ecb40f00 Mon Sep 17 00:00:00 2001 From: Egor Date: Mon, 19 Jan 2026 22:36:44 +0300 Subject: [PATCH] Update ConnectionModal.tsx --- src/components/ConnectionModal.tsx | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/src/components/ConnectionModal.tsx b/src/components/ConnectionModal.tsx index 0d4f22f..473022d 100644 --- a/src/components/ConnectionModal.tsx +++ b/src/components/ConnectionModal.tsx @@ -61,12 +61,8 @@ const platformIconComponents: Record = { // Platform order for display const platformOrder = ['ios', 'android', 'windows', 'macos', 'linux', 'androidTV', 'appleTV'] -// Allowed app schemes for deep links -const allowedAppSchemes = [ - 'happ://', 'flclash://', 'clash://', 'sing-box://', 'v2rayng://', - 'sub://', 'shadowrocket://', 'hiddify://', 'streisand://', - 'quantumult://', 'surge://', 'loon://', 'nekobox://', 'v2box://' -] +// Dangerous schemes that should never be allowed +const dangerousSchemes = ['javascript:', 'data:', 'vbscript:', 'file:'] /** * Validate URL to prevent XSS via javascript: and other dangerous schemes @@ -87,20 +83,20 @@ function isValidExternalUrl(url: string | undefined): boolean { } /** - * Validate deep link URL - only allows known VPN app schemes + * Validate deep link URL - blocks dangerous schemes only + * Allows any custom app scheme (clash://, hiddify://, etc.) */ function isValidDeepLink(url: string | undefined): boolean { if (!url) return false const lowerUrl = url.toLowerCase().trim() // Block dangerous schemes - const dangerousSchemes = ['javascript:', 'data:', 'vbscript:', 'file:'] if (dangerousSchemes.some(scheme => lowerUrl.startsWith(scheme))) { return false } - // Allow known app schemes - return allowedAppSchemes.some(scheme => lowerUrl.startsWith(scheme)) + // Allow any URL that has a scheme (contains ://) + return lowerUrl.includes('://') } // Detect user's platform from user agent