@lvce-editor/extension-detail-view 5.3.0 → 5.4.0

package/dist/extensionDetailViewWorkerMain.js

@@ -4546,12 +4546,28 @@ const getMarketplaceEntries = isBuiltin => {
   }];
 };
 
-const getRepositoryLink = extension => {
+const getRepositoryLinkRaw = extension => {
   if (extension && hasProperty(extension, 'repository') && typeof extension.repository === 'string') {
     return extension.repository; // TODO watch out for javascript: or other invalid links or path traversal
   }
   return '';
 };
+const ensureValidLink = link => {
+  if (!link) {
+    return '';
+  }
+  const parsed = new URL(link);
+  if (parsed.protocol !== 'https:') {
+    return '';
+  }
+  return link;
+};
+const getRepositoryLink = extension => {
+  const raw = getRepositoryLinkRaw(extension);
+  const validLink = ensureValidLink(raw);
+  return validLink;
+};
+
 const getResources = (isBuiltin, extension) => {
   if (isBuiltin) {
     return [];
@@ -4563,10 +4579,10 @@ const getResources = (isBuiltin, extension) => {
     url: '#'
   }, {
     label: issues(),
-    url: repositoryLink
+    url: '#'
   }, {
     label: repository(),
-    url: '#'
+    url: repositoryLink
   }, {
     label: license(),
     url: '#'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/extension-detail-view",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "description": "Extension Detail View Worker",
   "repository": {
     "type": "git",