@controleonline/ui-common 1.2.100 → 1.2.102

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@controleonline/ui-common",
-  "version": "1.2.100",
+  "version": "1.2.102",
   "author": "ControleOnline",
   "description": "ControleOnline Common Quasar UI Component",
   "license": "MIT",

package/src/react/components/UserAvatar.js

@@ -1,4 +1,5 @@
 import {readStoredSessionToken} from '../../utils/storedSessionToken';
+import {isTrustedApiUrl, filterApiHeaders} from '../../utils/trustedApiUrl';
 import React, {useEffect, useMemo, useState} from 'react';
 import {Image, Platform, StyleSheet, Text, View} from 'react-native';
 import {env as APP_ENV} from '@env';
@@ -78,7 +79,8 @@ const useDisplayUri = uri => {
       const token = readStoredSessionToken();
 
       // Authenticated backend download on web
-      if (isBackendDownloadUrl(next) && Platform.OS === 'web' && token) {
+      if (isBackendDownloadUrl(next) && isTrustedApiUrl(next, APP_ENV?.API_ENTRYPOINT)
+          && Platform.OS === 'web' && token) {
         try {
           const headers = {
             Accept: '*/*',
@@ -91,7 +93,7 @@ const useDisplayUri = uri => {
             headers['App-Domain'] = host;
           }
 
-          const response = await fetch(next, {method: 'GET', headers});
+          const response = await fetch(next, {method: 'GET', headers, redirect: 'error'});
           if (!response.ok) {
             if (!cancelled) {
               setDisplayUri('');
@@ -206,7 +208,7 @@ const UserAvatar = ({
       {displayUri ? (
         <Image
           source={imageHeaders && Platform.OS !== 'web' && displayUri === imageUrl
-            ? {uri: displayUri, headers: imageHeaders} : {uri: displayUri}}
+            ? {uri: displayUri, headers: filterApiHeaders(displayUri, imageHeaders, APP_ENV?.API_ENTRYPOINT)} : {uri: displayUri}}
           style={styles.image}
           onError={() => setSourceIndex(index => index + 1)}
         />

package/src/react/utils/fileUrl.js

@@ -1,4 +1,5 @@
 import {env as APP_ENV} from '@env';
+import {filterApiHeaders} from '../../utils/trustedApiUrl';
 import {buildAssetUrl} from '@controleonline/../../src/styles/branding';
 import {
   resolveAppDomain,
@@ -227,7 +228,7 @@ export const extractFileId = file => {
   return null;
 };
 
-export const resolveDefaultFileSource = (
+const resolveFileSource = (
   file,
   {company = null, appDomain = '', headers = {}} = {},
 ) => {
@@ -329,6 +330,11 @@ export const resolveDefaultFileSource = (
   return null;
 };
 
+export const resolveDefaultFileSource = (file, options = {}) => {
+  const source = resolveFileSource(file, options);
+  return source ? {...source, headers: filterApiHeaders(source.uri, source.headers, APP_ENV?.API_ENTRYPOINT)} : null;
+};
+
 export const resolveDefaultFileUrl = (file, options = {}) =>
   resolveDefaultFileSource(file, options)?.uri || '';
 

package/src/tests/react/components/UserAvatar.test.js

@@ -12,6 +12,8 @@ jest.mock('react-native', () => ({
   View: props => React.createElement('View', props, props.children),
 }));
 
+jest.mock('@env', () => ({env: {API_ENTRYPOINT: 'https://api.controleonline.com', DOMAIN: 'manager.controleonline.com'}}));
+
 const UserAvatar = require('../../../react/components/UserAvatar').default;
 
 const {describe, expect, it} = global;
@@ -54,3 +56,31 @@ describe('UserAvatar', () => {
     expect(image.props.source.uri).toContain('d=404');
   });
 });
+
+
+describe('avatar credential boundary', () => {
+  it('does not authenticate an external download-shaped image on web', async () => {
+    const {Platform} = require('react-native');
+    const previousStorage = global.localStorage;
+    const previousFetch = global.fetch;
+    Platform.OS = 'web';
+    global.localStorage = {getItem: () => JSON.stringify({token: 'session-secret'})};
+    global.fetch = jest.fn();
+    let tree;
+    try {
+      await renderer.act(async () => { tree = renderer.create(React.createElement(UserAvatar, {imageUrl: 'https://images.example.test/files/1/download', useGravatar: false})); });
+      expect(global.fetch).not.toHaveBeenCalled();
+      expect(tree.root.findByType('Image').props.source.uri).toBe('https://images.example.test/files/1/download');
+    } finally {
+      if (tree) await renderer.act(async () => tree.unmount());
+      Platform.OS = 'ios'; global.localStorage = previousStorage; global.fetch = previousFetch;
+    }
+  });
+  it('removes session headers from external native avatars', async () => {
+    let tree;
+    try {
+      await renderer.act(async () => { tree = renderer.create(React.createElement(UserAvatar, {imageUrl: 'https://images.example.test/avatar.png', imageHeaders: {'API-TOKEN': 'session-secret', Accept: 'image/*'}, useGravatar: false})); });
+      expect(tree.root.findByType('Image').props.source.headers).toEqual({Accept: 'image/*'});
+    } finally { if (tree) await renderer.act(async () => tree.unmount()); }
+  });
+});

package/src/tests/react/utils/fileUrl.test.js

@@ -60,7 +60,7 @@ describe('fileUrl helpers', () => {
     });
   });
 
-  it('does not path-inject environment hosts like staging (app-community#432)', () => {
+  it('keeps the explicit environment domain on the registered download route', () => {
     const source = resolveDefaultFileSource(
       {
         id: 8444,
@@ -77,24 +77,41 @@ describe('fileUrl helpers', () => {
     );
 
     expect(source).toEqual({
-      uri: 'https://api.controleonline.com/files/8444/download',
+      uri: 'https://api.controleonline.com/staging.controleonline.com/files/8444/download',
       headers: {
         Authorization: 'Bearer token',
         'app-domain': 'staging.controleonline.com',
       },
     });
-    expect(source.uri).not.toContain('staging.controleonline.com/files');
+    expect(source.uri).toContain('staging.controleonline.com/files');
   });
 
-  it('does not path-inject when fallback DOMAIN is manager platform host', () => {
+  it('uses the configured platform domain on the registered download route', () => {
     // DOMAIN mock is manager.controleonline.com; no company → environment-like
     const source = resolveDefaultFileSource(
       {id: 9, url: '/files/9/download'},
       {headers: {Authorization: 'Bearer t'}},
     );
 
-    expect(source.uri).toBe('https://api.controleonline.com/files/9/download');
+    expect(source.uri).toBe('https://api.controleonline.com/manager.controleonline.com/files/9/download');
     expect(source.headers['app-domain']).toBe('manager.controleonline.com');
-    expect(source.uri).not.toMatch(/manager\.controleonline\.com\/files/);
+    expect(source.uri).toMatch(/manager\.controleonline\.com\/files/);
+  });
+});
+
+
+describe('file authentication origin boundary', () => {
+  it('removes ERP credentials from external images and download-shaped URLs', () => {
+    for (const uri of ['https://images.example.test/image.png', 'https://images.example.test/files/1/download', '//images.example.test/image.png']) {
+      const source = resolveDefaultFileSource(uri, {headers: {'API-TOKEN': 'session-secret', Authorization: 'Bearer session-secret', 'App-Domain': 'tenant.test', Accept: 'image/*'}});
+      expect(source.headers).not.toHaveProperty('API-TOKEN');
+      expect(source.headers).not.toHaveProperty('Authorization');
+      expect(source.headers).not.toHaveProperty('App-Domain');
+      expect(source.headers.Accept).toBe('image/*');
+    }
+  });
+  it('preserves authentication on the configured API download', () => {
+    const source = resolveDefaultFileSource(1, {headers: {'API-TOKEN': 'session-secret'}});
+    expect(source.headers['API-TOKEN']).toBe('session-secret');
   });
 });

package/src/utils/trustedApiUrl.js

@@ -0,0 +1,19 @@
+const isTrustedApiUrl = (uri, apiEntryPoint) => {
+  try {
+    const base = new URL(String(apiEntryPoint || ''));
+    const target = new URL(String(uri || ''), `${base.href.replace(/\/$/, '')}/`);
+    const prefix = base.pathname.replace(/\/$/, '');
+    return ['http:', 'https:'].includes(base.protocol)
+      && target.origin === base.origin && !target.username && !target.password
+      && (!prefix || target.pathname === prefix || target.pathname.startsWith(`${prefix}/`));
+  } catch { return false; }
+};
+
+// ERP credentials belong only to the configured API, never an image/CDN origin.
+const filterApiHeaders = (uri, headers = {}, apiEntryPoint) => {
+  if (isTrustedApiUrl(uri, apiEntryPoint)) return {...headers};
+  return Object.fromEntries(Object.entries(headers).filter(([key]) =>
+    !/^(api[-_]?(token|key)|authorization|proxy-authorization|cookie|app-domain|device)$/i.test(key)));
+};
+
+module.exports = {isTrustedApiUrl, filterApiHeaders};