@esri/hub-common 11.4.1 → 11.5.0

package/dist/esm/urls/index.js

@@ -19,6 +19,7 @@ export * from "./getPortalBaseFromOrgUrl";
 export * from "./getGroupHomeUrl";
 export * from "./getUserHomeUrl";
 export * from "./get-campaign-url";
+export * from "./is-safe-redirect-url";
 const MAP_OR_FEATURE_SERVER_URL_REGEX = /\/(map|feature)server/i;
 /**
  *

package/dist/esm/urls/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/urls/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AAEnC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE;IACrD,OAAO,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAE,EAAE;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,YAAY,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC;AAC/D,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/urls/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAEvC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE;IACrD,OAAO,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAE,EAAE;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,YAAY,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC;AAC/D,CAAC,CAAC"}

package/dist/esm/urls/is-safe-redirect-url.js

@@ -0,0 +1,31 @@
+import { __rest } from "tslib";
+import { domainExists } from "../sites/domains/domain-exists";
+const SAFE_REDIRECT_URL = new RegExp("^https?:\\/\\/([a-z0-9-]+\\.)*(arcgis|esri)\\.com");
+const HTTP_PROTOCOL = new RegExp("^https?:$");
+/**
+ * Determines if a given URL is safe to redirect to.
+ * All URLs to *.esri.com and *.arcgis.com are considered
+ * safe. Non esri/arcgis domains must have a domain record.
+ * @param options.url url A URL
+ * @param ...options An IHubRequestOptions object
+ * @returns a promise that resolves a boolean
+ */
+export async function isSafeRedirectUrl(options) {
+    const { url } = options, hubRequestOptions = __rest(options, ["url"]);
+    let isSafe;
+    try {
+        isSafe = SAFE_REDIRECT_URL.test(url);
+        if (!isSafe) {
+            const { protocol, hostname } = new URL(url);
+            if (!HTTP_PROTOCOL.test(protocol)) {
+                throw new Error("invalid protocol");
+            }
+            isSafe = await domainExists(hostname, hubRequestOptions);
+        }
+    }
+    catch (e) {
+        isSafe = false;
+    }
+    return isSafe;
+}
+//# sourceMappingURL=is-safe-redirect-url.js.map

package/dist/esm/urls/is-safe-redirect-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-safe-redirect-url.js","sourceRoot":"","sources":["../../../src/urls/is-safe-redirect-url.ts"],"names":[],"mappings":";AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,mDAAmD,CACpD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;AAM9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAkC;IAElC,MAAM,EAAE,GAAG,KAA2B,OAAO,EAA7B,iBAAiB,UAAK,OAAO,EAAvC,OAA6B,CAAU,CAAC;IAC9C,IAAI,MAAM,CAAC;IACX,IAAI;QACF,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE;YACX,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACjC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;aACrC;YACD,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;SAC1D;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,GAAG,KAAK,CAAC;KAChB;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/node/urls/index.js

@@ -23,6 +23,7 @@ tslib_1.__exportStar(require("./getPortalBaseFromOrgUrl"), exports);
 tslib_1.__exportStar(require("./getGroupHomeUrl"), exports);
 tslib_1.__exportStar(require("./getUserHomeUrl"), exports);
 tslib_1.__exportStar(require("./get-campaign-url"), exports);
+tslib_1.__exportStar(require("./is-safe-redirect-url"), exports);
 const MAP_OR_FEATURE_SERVER_URL_REGEX = /\/(map|feature)server/i;
 /**
  *

package/dist/node/urls/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/urls/index.ts"],"names":[],"mappings":";;;;AAAA,kCAAqC;AACrC,sDAA4B;AAC5B,qEAA2C;AAC3C,+DAAqC;AACrC,2DAAiC;AACjC,2DAAiC;AACjC,6DAAmC;AACnC,2DAAiC;AACjC,qEAA2C;AAC3C,0DAAgC;AAChC,wEAA8C;AAC9C,oEAA0C;AAC1C,8DAAoC;AACpC,6DAAmC;AACnC,8DAAoC;AACpC,wEAA8C;AAC9C,mEAAyC;AACzC,oEAA0C;AAC1C,4DAAkC;AAClC,2DAAiC;AACjC,6DAAmC;AAEnC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEjE;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE;IACrD,OAAO,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,CAAC,GAAW,EAAE,EAAE;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,YAAY,IAAI,GAAG,iBAAU,CAAC,YAAY,CAAC,UAAU,CAAC;AAC/D,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/urls/index.ts"],"names":[],"mappings":";;;;AAAA,kCAAqC;AACrC,sDAA4B;AAC5B,qEAA2C;AAC3C,+DAAqC;AACrC,2DAAiC;AACjC,2DAAiC;AACjC,6DAAmC;AACnC,2DAAiC;AACjC,qEAA2C;AAC3C,0DAAgC;AAChC,wEAA8C;AAC9C,oEAA0C;AAC1C,8DAAoC;AACpC,6DAAmC;AACnC,8DAAoC;AACpC,wEAA8C;AAC9C,mEAAyC;AACzC,oEAA0C;AAC1C,4DAAkC;AAClC,2DAAiC;AACjC,6DAAmC;AACnC,iEAAuC;AAEvC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEjE;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE;IACrD,OAAO,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,CAAC,GAAW,EAAE,EAAE;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,YAAY,IAAI,GAAG,iBAAU,CAAC,YAAY,CAAC,UAAU,CAAC;AAC/D,CAAC,CAAC"}

package/dist/node/urls/is-safe-redirect-url.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeRedirectUrl = void 0;
+const tslib_1 = require("tslib");
+const domain_exists_1 = require("../sites/domains/domain-exists");
+const SAFE_REDIRECT_URL = new RegExp("^https?:\\/\\/([a-z0-9-]+\\.)*(arcgis|esri)\\.com");
+const HTTP_PROTOCOL = new RegExp("^https?:$");
+/**
+ * Determines if a given URL is safe to redirect to.
+ * All URLs to *.esri.com and *.arcgis.com are considered
+ * safe. Non esri/arcgis domains must have a domain record.
+ * @param options.url url A URL
+ * @param ...options An IHubRequestOptions object
+ * @returns a promise that resolves a boolean
+ */
+async function isSafeRedirectUrl(options) {
+    const { url } = options, hubRequestOptions = tslib_1.__rest(options, ["url"]);
+    let isSafe;
+    try {
+        isSafe = SAFE_REDIRECT_URL.test(url);
+        if (!isSafe) {
+            const { protocol, hostname } = new URL(url);
+            if (!HTTP_PROTOCOL.test(protocol)) {
+                throw new Error("invalid protocol");
+            }
+            isSafe = await domain_exists_1.domainExists(hostname, hubRequestOptions);
+        }
+    }
+    catch (e) {
+        isSafe = false;
+    }
+    return isSafe;
+}
+exports.isSafeRedirectUrl = isSafeRedirectUrl;
+//# sourceMappingURL=is-safe-redirect-url.js.map

package/dist/node/urls/is-safe-redirect-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-safe-redirect-url.js","sourceRoot":"","sources":["../../../src/urls/is-safe-redirect-url.ts"],"names":[],"mappings":";;;;AAAA,kEAA8D;AAG9D,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,mDAAmD,CACpD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;AAM9C;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAAkC;IAElC,MAAM,EAAE,GAAG,KAA2B,OAAO,EAA7B,iBAAiB,kBAAK,OAAO,EAAvC,OAA6B,CAAU,CAAC;IAC9C,IAAI,MAAM,CAAC;IACX,IAAI;QACF,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE;YACX,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACjC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;aACrC;YACD,MAAM,GAAG,MAAM,4BAAY,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;SAC1D;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,GAAG,KAAK,CAAC;KAChB;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAlBD,8CAkBC"}

package/dist/types/urls/index.d.ts

@@ -18,6 +18,7 @@ export * from "./getPortalBaseFromOrgUrl";
 export * from "./getGroupHomeUrl";
 export * from "./getUserHomeUrl";
 export * from "./get-campaign-url";
+export * from "./is-safe-redirect-url";
 /**
  *
  * @param url

package/dist/types/urls/is-safe-redirect-url.d.ts

@@ -0,0 +1,14 @@
+import { IHubRequestOptions } from "../types";
+interface IIsSafeRedirectUrlOptions extends IHubRequestOptions {
+    url: string;
+}
+/**
+ * Determines if a given URL is safe to redirect to.
+ * All URLs to *.esri.com and *.arcgis.com are considered
+ * safe. Non esri/arcgis domains must have a domain record.
+ * @param options.url url A URL
+ * @param ...options An IHubRequestOptions object
+ * @returns a promise that resolves a boolean
+ */
+export declare function isSafeRedirectUrl(options: IIsSafeRedirectUrlOptions): Promise<boolean>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@esri/hub-common",
-  "version": "11.4.1",
+  "version": "11.5.0",
   "description": "Common TypeScript types and utility functions for @esri/hub.js.",
   "main": "dist/node/index.js",
   "module": "dist/esm/index.js",