@arcblock/ux 2.10.84 → 2.10.86

package/lib/Util/security.d.ts

@@ -1,6 +1,8 @@
-export declare function getSafeUrl(url: string, { throwOnError, returnRaw, allowProtocol, allowHost, }?: {
-    throwOnError?: boolean | undefined;
-    returnRaw?: boolean | undefined;
-    allowProtocol?: string[] | undefined;
-    allowHost?: string[] | undefined;
-}): string | null;
+type GetSafeUrlOptions = {
+    returnRaw?: boolean;
+    throwOnError?: Boolean;
+    allowProtocols?: Array<string> | null;
+    allowDomains?: Array<string> | null;
+};
+export declare function getSafeUrl(url: string, { throwOnError, returnRaw, allowProtocols, allowDomains, }?: GetSafeUrlOptions): string | null;
+export {};

package/lib/Util/security.js

@@ -7,10 +7,15 @@ url, {
   throwOnError = true,
   returnRaw = false,
   // 根据 URL 的规范，protocol 以 : 结尾
-  allowProtocol = ['https:', 'http:'],
+  allowProtocols = ['https:', 'http:'],
   // host 中可能会携带端口号，需要使用 hostname 来获取干净的域名
-  allowHost = [window.location.href]
+  allowDomains = undefined
 } = {}) {
+  if (allowDomains === undefined) {
+    // eslint-disable-next-line no-param-reassign
+    allowDomains = window.blocklet?.domainAliases || [];
+    allowDomains.push(window.location.href);
+  }
   try {
     let base;
     if (url.startsWith('/')) {
@@ -19,8 +24,15 @@ url, {
       base = window.location.href;
     }
     const urlInstance = new URL(url, base);
-    const allowHostName = allowHost ? allowHost.map(host => new URL(host).hostname) : allowHost;
-    if (allowProtocol !== null && !allowProtocol.includes(urlInstance.protocol)) {
+    const allowHostName = allowDomains ? allowDomains.map(host => {
+      try {
+        return new URL(host).hostname;
+      } catch {
+        // HACK: 如果传入的 allowDomains 不包含协议，则尝试为它添加协议头
+        return new URL(`https://${host}`).hostname;
+      }
+    }) : allowDomains;
+    if (allowProtocols !== null && !allowProtocols.includes(urlInstance.protocol)) {
       console.error(`Invalid protocol: ${urlInstance.protocol}`);
       if (throwOnError) throw new CustomError(`Invalid protocol: ${urlInstance.protocol}`);
       return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcblock/ux",
-  "version": "2.10.84",
+  "version": "2.10.86",
   "description": "Common used react components for arcblock products",
   "keywords": [
     "react",
@@ -68,12 +68,12 @@
     "react": ">=18.2.0",
     "react-router-dom": ">=6.22.3"
   },
-  "gitHead": "1311dd7d9ce3a6b0164404de828e64dcd900ce6d",
+  "gitHead": "bc6f365772401070c253a364abad0269479d5bff",
   "dependencies": {
     "@arcblock/did-motif": "^1.1.13",
-    "@arcblock/icons": "^2.10.84",
-    "@arcblock/nft-display": "^2.10.84",
-    "@arcblock/react-hooks": "^2.10.84",
+    "@arcblock/icons": "^2.10.86",
+    "@arcblock/nft-display": "^2.10.86",
+    "@arcblock/react-hooks": "^2.10.86",
     "@babel/plugin-syntax-dynamic-import": "^7.8.3",
     "@fontsource/inter": "^5.0.16",
     "@fontsource/ubuntu-mono": "^5.0.18",

package/src/Util/security.ts

@@ -4,9 +4,9 @@ type GetSafeUrlOptions = {
   returnRaw?: boolean;
   throwOnError?: Boolean;
   // 为 null 时代表不检查 protocol
-  allowProtocol?: Array<string> | null;
+  allowProtocols?: Array<string> | null;
   // 为 null 时代表不检查 host
-  allowHost?: Array<string> | null;
+  allowDomains?: Array<string> | null;
 };
 
 class CustomError extends Error {}
@@ -18,11 +18,16 @@ export function getSafeUrl(
     throwOnError = true,
     returnRaw = false,
     // 根据 URL 的规范，protocol 以 : 结尾
-    allowProtocol = ['https:', 'http:'],
+    allowProtocols = ['https:', 'http:'],
     // host 中可能会携带端口号，需要使用 hostname 来获取干净的域名
-    allowHost = [window.location.href],
-  } = {}
+    allowDomains = undefined,
+  }: GetSafeUrlOptions = {}
 ) {
+  if (allowDomains === undefined) {
+    // eslint-disable-next-line no-param-reassign
+    allowDomains = window.blocklet?.domainAliases || [];
+    (allowDomains as unknown as Array<String>).push(window.location.href);
+  }
   try {
     let base;
     if (url.startsWith('/')) {
@@ -32,8 +37,18 @@ export function getSafeUrl(
     }
 
     const urlInstance = new URL(url, base);
-    const allowHostName = allowHost ? allowHost.map((host) => new URL(host).hostname) : allowHost;
-    if (allowProtocol !== null && !allowProtocol.includes(urlInstance.protocol)) {
+    const allowHostName = allowDomains
+      ? (allowDomains as Array<string>).map((host) => {
+          try {
+            return new URL(host).hostname;
+          } catch {
+            // HACK: 如果传入的 allowDomains 不包含协议，则尝试为它添加协议头
+            return new URL(`https://${host}`).hostname;
+          }
+        })
+      : (allowDomains as unknown as null);
+
+    if (allowProtocols !== null && !allowProtocols.includes(urlInstance.protocol)) {
       console.error(`Invalid protocol: ${urlInstance.protocol}`);
       if (throwOnError) throw new CustomError(`Invalid protocol: ${urlInstance.protocol}`);
       return null;