PromucFlow_constructor/app/client/src/sagas/ActionExecution/NavigateActionSaga.ts
arunvjn 37afa0cc26
fix: fixed URL validation to not restrict navigateTo URLs to limited protocols (#27399)
## Description
Currently, we check to see if the URL that is passed to the `navigateTo`
method starts with http(s), mailTo or tel. This limits the capability to
load/navigate to other URLs that do not conform to these protocols. This
PR remove this crude protocol check and only checks to see if the
navigateTo argument is a valid URL.
>
> Links to Notion, Figma or any other documents that might be relevant
to the PR
>
>
#### PR fixes following issue(s)
Fixes #4878 
>
>
#### Media
> A video or a GIF is preferred. when using Loom, don’t embed because it
looks like it’s a GIF. instead, just link to the video
>
>
#### Type of change
- Bug fix (non-breaking change which fixes an issue)
- New feature (non-breaking change which adds functionality)
>
>
>
## Testing
>
#### How Has This Been Tested?
- [x] Manual
>
>
#### Test Plan
1. Verify NavigateTo() for https:// mailTo ftp urls
2. Verify NavigateTo for above protocol from jsobject and from Action
selector
3. Verify NavigateTo for same and NewWindow with above URLs

#### Issues raised during DP testing
> Link issues raised during DP testing for better visiblity and tracking
(copy link from comments dropped on this PR)
>
>
>
## Checklist:
#### Dev activity
- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [ ] PR is being merged under a feature flag


#### QA activity:
- [ ] [Speedbreak
features](https://github.com/appsmithorg/TestSmith/wiki/Guidelines-for-test-plans#speedbreakers-)
have been covered
- [ ] Test plan covers all impacted features and [areas of
interest](https://github.com/appsmithorg/TestSmith/wiki/Guidelines-for-test-plans#areas-of-interest-)
- [ ] Test plan has been peer reviewed by project stakeholders and other
QA members
- [ ] Manually tested functionality on DP
- [ ] We had an implementation alignment call with stakeholders post QA
Round 2
- [ ] Cypress test cases have been added and approved by SDET/manual QA
- [ ] Added `Test Plan Approved` label after Cypress tests were reviewed
- [ ] Added `Test Plan Approved` label after JUnit tests were reviewed
2023-09-21 07:02:37 +05:30

102 lines
3.2 KiB
TypeScript

import { call, select } from "redux-saga/effects";
import { getCurrentPageId, getPageList } from "selectors/editorSelectors";
import _ from "lodash";
import type { Page } from "@appsmith/constants/ReduxActionConstants";
import AnalyticsUtil from "utils/AnalyticsUtil";
import { getAppMode } from "@appsmith/selectors/applicationSelectors";
import { APP_MODE } from "entities/App";
import { getQueryStringfromObject } from "RouteBuilder";
import history from "utils/history";
import { setDataUrl } from "sagas/PageSagas";
import AppsmithConsole from "utils/AppsmithConsole";
import { builderURL, viewerURL } from "RouteBuilder";
import { TriggerFailureError } from "./errorUtils";
import { isValidURL, matchesURLPattern } from "utils/URLUtils";
import type { TNavigateToDescription } from "workers/Evaluation/fns/navigateTo";
import { NavigationTargetType } from "workers/Evaluation/fns/navigateTo";
export enum NavigationTargetType_Dep {
SAME_WINDOW = "SAME_WINDOW",
NEW_WINDOW = "NEW_WINDOW",
}
const isValidPageName = (
pageNameOrUrl: string,
pageList: Page[],
): Page | undefined => {
return _.find(pageList, (page: Page) => page.pageName === pageNameOrUrl);
};
export default function* navigateActionSaga(action: TNavigateToDescription) {
const { payload } = action;
const pageList: Page[] = yield select(getPageList);
const { pageNameOrUrl, params, target } = payload;
const page = isValidPageName(pageNameOrUrl, pageList);
if (page) {
const currentPageId: string = yield select(getCurrentPageId);
AnalyticsUtil.logEvent("NAVIGATE", {
pageName: pageNameOrUrl,
pageParams: params,
});
const appMode: APP_MODE = yield select(getAppMode);
const path =
appMode === APP_MODE.EDIT
? builderURL({
pageId: page.pageId,
params,
})
: viewerURL({
pageId: page.pageId,
params,
});
if (target === NavigationTargetType.SAME_WINDOW) {
history.push(path);
if (currentPageId === page.pageId) {
yield call(setDataUrl);
}
} else if (target === NavigationTargetType.NEW_WINDOW) {
window.open(path, "_blank");
}
AppsmithConsole.info({
text: `navigateTo('${page.pageName}') was triggered`,
state: {
params,
},
});
} else {
let url = pageNameOrUrl + getQueryStringfromObject(params);
if (!isValidURL(url)) {
const looksLikeURL = matchesURLPattern(url);
// Filter out cases like navigateTo("1");
if (!looksLikeURL)
throw new TriggerFailureError("Enter a valid URL or page name");
// Default to https protocol to support navigation to URLs like www.google.com
url = `https://${url}`;
if (!isValidURL(url))
throw new TriggerFailureError("Enter a valid URL or page name");
}
if (target === NavigationTargetType.SAME_WINDOW) {
window.location.assign(url);
} else if (target === NavigationTargetType.NEW_WINDOW) {
window.open(url, "_blank");
}
AppsmithConsole.info({
text: `navigateTo('${url}') was triggered`,
state: {
params,
},
});
AnalyticsUtil.logEvent("NAVIGATE", {
navUrl: pageNameOrUrl,
});
}
}