ehealthsolutions/element-x-ios
3
0
Fork 0
mirror of https://github.com/Novaloop-AG/element-x-ios.git synced 2026-11-03 16:10:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Only allow https call links to be passed through the custom app scheme

Browse Source
This commit is contained in:
Stefan Ceriu
2023-09-25 09:17:44 +03:00
parent 22756891c1
commit 44c6da7ce6
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ElementX/Sources/Application/Navigation/AppRoutes.swift
+3 -1
View File
@@ -91,7 +91,9 @@ struct ElementCallURLParser: URLParser {
} }
guard let encodedURLString = components.queryItems?.first(where: { $0.name == customSchemeURLQueryParameterName })?.value, guard let encodedURLString = components.queryItems?.first(where: { $0.name == customSchemeURLQueryParameterName })?.value,
let callURL = URL(string: encodedURLString) else { let callURL = URL(string: encodedURLString),
callURL.scheme == "https" // Don't allow URLs from potentially unsafe domains
else {
MXLog.error("Invalid custom scheme call parameters: \(url)") MXLog.error("Invalid custom scheme call parameters: \(url)")
return nil return nil
} }