@mintlify/common 1.0.831 → 1.0.833

package/dist/index.d.ts

@@ -33,3 +33,4 @@ export * from './editor/index.js';
 export * from './isOrgLessThanTwoWeeksOld.js';
 export * from './entitlements/index.js';
 export * from './validateRedirectUrl.js';
+export * from './isAllowedRedirectUri.js';

package/dist/index.js

@@ -33,3 +33,4 @@ export * from './editor/index.js';
 export * from './isOrgLessThanTwoWeeksOld.js';
 export * from './entitlements/index.js';
 export * from './validateRedirectUrl.js';
+export * from './isAllowedRedirectUri.js';

package/dist/isAbsoluteUrl.js

@@ -20,7 +20,7 @@ export const isAbsoluteUrl = (url) => {
     if (!url || typeof url !== 'string')
         return false;
     try {
-        if (!URL.canParse(url))
+        if (typeof URL.canParse === 'function' && !URL.canParse(url))
             return false;
         const parsedUrl = new URL(url);
         const protocol = parsedUrl.protocol.slice(0, -1);

package/dist/isAllowedRedirectUri.d.ts

@@ -0,0 +1 @@
+export declare function isAllowedRedirectUri(uri: string, allowedDomains: string[]): boolean;

package/dist/isAllowedRedirectUri.js

@@ -0,0 +1,35 @@
+const LOOPBACK_HOSTS = ['localhost', '127.0.0.1', '[::1]'];
+const DANGEROUS_PROTOCOLS = new Set([
+    'javascript:',
+    'data:',
+    'vbscript:',
+    'file:',
+    'about:',
+    'blob:',
+]);
+export function isAllowedRedirectUri(uri, allowedDomains) {
+    try {
+        const parsed = new URL(uri);
+        if (DANGEROUS_PROTOCOLS.has(parsed.protocol)) {
+            return false;
+        }
+        if (LOOPBACK_HOSTS.includes(parsed.hostname)) {
+            return true;
+        }
+        return allowedDomains.some((entry) => {
+            if (entry.includes('://')) {
+                try {
+                    const allowed = new URL(entry);
+                    return parsed.protocol === allowed.protocol && parsed.hostname === allowed.hostname;
+                }
+                catch (_a) {
+                    return false;
+                }
+            }
+            return parsed.protocol === 'https:' && parsed.hostname === entry;
+        });
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/isAllowedRedirectUri.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/isAllowedRedirectUri.test.js

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest';
+import { isAllowedRedirectUri } from './isAllowedRedirectUri.js';
+describe('isAllowedRedirectUri', () => {
+    it('allows loopback addresses', () => {
+        expect(isAllowedRedirectUri('http://localhost:3000/callback', [])).toBe(true);
+        expect(isAllowedRedirectUri('http://127.0.0.1:8080/callback', [])).toBe(true);
+        expect(isAllowedRedirectUri('http://[::1]:3000/callback', [])).toBe(true);
+    });
+    it('rejects dangerous protocols', () => {
+        expect(isAllowedRedirectUri('javascript:alert(1)', [])).toBe(false);
+        expect(isAllowedRedirectUri('data:text/html,<h1>hi</h1>', [])).toBe(false);
+        expect(isAllowedRedirectUri('vbscript:msgbox', [])).toBe(false);
+        expect(isAllowedRedirectUri('file:///etc/passwd', [])).toBe(false);
+        expect(isAllowedRedirectUri('about:blank', [])).toBe(false);
+        expect(isAllowedRedirectUri('blob:http://example.com/abc', [])).toBe(false);
+    });
+    it('allows domains in the allowed list (plain hostname)', () => {
+        expect(isAllowedRedirectUri('https://example.com/callback', ['example.com'])).toBe(true);
+    });
+    it('rejects non-https for plain hostname entries', () => {
+        expect(isAllowedRedirectUri('http://example.com/callback', ['example.com'])).toBe(false);
+    });
+    it('allows domains in the allowed list (full URL entry)', () => {
+        expect(isAllowedRedirectUri('https://example.com/callback', ['https://example.com'])).toBe(true);
+    });
+    it('allows matching protocol+hostname for URL entries', () => {
+        expect(isAllowedRedirectUri('http://example.com/callback', ['http://example.com'])).toBe(true);
+    });
+    it('rejects mismatched protocol for URL entries', () => {
+        expect(isAllowedRedirectUri('http://example.com/callback', ['https://example.com'])).toBe(false);
+    });
+    it('rejects domains not in the allowed list', () => {
+        expect(isAllowedRedirectUri('https://evil.com/callback', ['example.com'])).toBe(false);
+    });
+    it('returns false for invalid URIs', () => {
+        expect(isAllowedRedirectUri('not-a-url', ['example.com'])).toBe(false);
+    });
+    it('returns false for invalid entries in allowed domains', () => {
+        expect(isAllowedRedirectUri('https://example.com/cb', ['://invalid'])).toBe(false);
+    });
+});