swift/Beam
swift/Beam
1
0
Fork 0
mirror of https://github.com/element-hq/element-x-ios.git synced 2025-03-10 21:39:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Only allow https call links to be passed through the custom app scheme

Browse Source
This commit is contained in:
Stefan Ceriu 2023-09-25 09:17:44 +03:00
parent 22756891c1
commit 44c6da7ce6
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ElementX/Sources/Application/Navigation/AppRoutes.swift
View File

@ -91,7 +91,9 @@ struct ElementCallURLParser: URLParser {
}
guard let encodedURLString = components.queryItems?.first(where: { $0.name == customSchemeURLQueryParameterName })?.value,
let callURL = URL(string: encodedURLString) else {
let callURL = URL(string: encodedURLString),
callURL.scheme == "https" // Don't allow URLs from potentially unsafe domains
else {
MXLog.error("Invalid custom scheme call parameters: \(url)")
return nil
}