@b3dotfun/sdk 0.0.63 → 0.0.64-alpha.0

package/src/global-account/react/utils/profileDisplay.ts

@@ -1,5 +1,68 @@
+import { debugB3React } from "@b3dotfun/sdk/shared/utils/debug";
 import { type Profile } from "thirdweb/wallets";
 
+const debug = debugB3React("profileDisplay");
+
+/**
+ * Validates that an image URL uses an allowed schema
+ * @param url - The URL to validate
+ * @returns The URL if valid, null otherwise
+ */
+export function validateImageUrl(url: string | null | undefined): string | null {
+  if (!url) return null;
+
+  try {
+    // For blob URLs (from createObjectURL)
+    if (url.startsWith("blob:")) {
+      return url;
+    }
+
+    // For IPFS protocol URLs
+    if (url.startsWith("ipfs://")) {
+      return url;
+    }
+
+    // Parse URL to validate protocol and hostname
+    const parsedUrl = new URL(url);
+
+    // Only allow http and https protocols
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+      debug("Rejected unsafe protocol:", parsedUrl.protocol, url);
+      return null;
+    }
+
+    // Whitelist of allowed IPFS gateway hostnames
+    const allowedIpfsGateways = [
+      "ipfs.io",
+      "gateway.pinata.cloud",
+      "cloudflare-ipfs.com",
+      "dweb.link",
+      "nftstorage.link",
+      "w3s.link",
+    ];
+
+    // Check if hostname matches allowed IPFS gateways
+    const hostname = parsedUrl.hostname.toLowerCase();
+    const isAllowedIpfsGateway = allowedIpfsGateways.some(gateway => {
+      // Exact match or subdomain of the gateway
+      return hostname === gateway || hostname.endsWith(`.${gateway}`);
+    });
+
+    if (isAllowedIpfsGateway) {
+      return url;
+    }
+
+    // For standard HTTP(S) URLs from trusted sources
+    // Add additional hostname validation here if needed
+    // For now, allow all HTTP(S) URLs (can be restricted further if needed)
+    return url;
+  } catch (error) {
+    // Invalid URL format
+    debug("Invalid image URL format:", url, error);
+    return null;
+  }
+}
+
 export interface ExtendedProfileDetails {
   id?: string;
   email?: string;
@@ -40,7 +103,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.name || details.username || "Unknown",
         subtitle: details.username ? `@${details.username}` : "X Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "X",
         type,
       };
@@ -49,7 +112,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.name || details.username || "Unknown",
         subtitle: details.username ? `@${details.username}` : "Farcaster Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "F",
         type,
       };
@@ -58,7 +121,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.name || details.email || "Unknown",
         subtitle: details.email || "Google Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "G",
         type,
       };
@@ -67,7 +130,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.username || details.name || "Unknown",
         subtitle: "Discord Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "D",
         type,
       };