@transferwise/components 0.0.0-experimental-1d81581 → 0.0.0-experimental-a06eb0d

package/src/Markup/utils/sanitise.test.ts

@@ -1,387 +1,389 @@
-import { isAllowedHref, isHrefAllowedByMode } from './sanitise';
+import { isHrefAllowedByMode, sanitiseHref } from './sanitise';
 
-describe('isAllowedHref', () => {
+describe('sanitiseHref', () => {
   describe('allowed protocols', () => {
     it('allows https URLs', () => {
-      expect(isAllowedHref('https://example.com')).toBe(true);
+      expect(sanitiseHref('https://example.com')).toBeDefined();
     });
 
     it('allows mailto URLs', () => {
-      expect(isAllowedHref('mailto:user@example.com')).toBe(true);
+      expect(sanitiseHref('mailto:user@example.com')).toBeDefined();
     });
 
     it('blocks http URLs', () => {
-      expect(isAllowedHref('http://example.com')).toBe(false);
+      expect(sanitiseHref('http://example.com')).toBeUndefined();
     });
 
     it('blocks tel URLs', () => {
-      expect(isAllowedHref('tel:+1234567890')).toBe(false);
+      expect(sanitiseHref('tel:+1234567890')).toBeUndefined();
     });
   });
 
   describe('allowed relative paths', () => {
     it('allows root-relative paths', () => {
-      expect(isAllowedHref('/settings')).toBe(true);
+      expect(sanitiseHref('/settings')).toBeDefined();
     });
 
     it('allows hash fragments', () => {
-      expect(isAllowedHref('#section')).toBe(true);
+      expect(sanitiseHref('#section')).toBeDefined();
     });
   });
 
   describe('blocked relative paths', () => {
     it('blocks dot-relative paths', () => {
-      expect(isAllowedHref('./page')).toBe(false);
+      expect(sanitiseHref('./page')).toBeUndefined();
     });
 
     it('blocks parent-relative paths', () => {
-      expect(isAllowedHref('../page')).toBe(false);
+      expect(sanitiseHref('../page')).toBeUndefined();
     });
 
     it('blocks dot-relative paths with query parameters', () => {
-      expect(isAllowedHref('./page?time=10:30')).toBe(false);
+      expect(sanitiseHref('./page?time=10:30')).toBeUndefined();
     });
 
     it('blocks bare relative paths with colons in segments', () => {
-      expect(isAllowedHref('page?key=value:other')).toBe(false);
+      expect(sanitiseHref('page?key=value:other')).toBeUndefined();
     });
   });
 
   describe('blocked protocols', () => {
     it('blocks javascript: protocol', () => {
       // eslint-disable-next-line no-script-url
-      expect(isAllowedHref('javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks javascript: with mixed case', () => {
       // eslint-disable-next-line no-script-url
-      expect(isAllowedHref('JavaScript:alert(1)')).toBe(false);
+      expect(sanitiseHref('JavaScript:alert(1)')).toBeUndefined();
     });
 
     it('blocks data: protocol', () => {
-      expect(isAllowedHref('data:text/html,<script>alert(1)</script>')).toBe(false);
+      expect(sanitiseHref('data:text/html,<script>alert(1)</script>')).toBeUndefined();
     });
 
     it('blocks vbscript: protocol', () => {
-      expect(isAllowedHref('vbscript:MsgBox("xss")')).toBe(false);
+      expect(sanitiseHref('vbscript:MsgBox("xss")')).toBeUndefined();
     });
 
     it('blocks unknown protocols', () => {
-      expect(isAllowedHref('ftp://evil.com')).toBe(false);
+      expect(sanitiseHref('ftp://evil.com')).toBeUndefined();
     });
   });
 
   describe('protocol-relative URLs', () => {
     it('blocks protocol-relative URLs', () => {
-      expect(isAllowedHref('//evil.com/phishing')).toBe(false);
+      expect(sanitiseHref('//evil.com/phishing')).toBeUndefined();
     });
 
     it('blocks protocol-relative URLs with whitespace', () => {
-      expect(isAllowedHref('  //evil.com  ')).toBe(false);
+      expect(sanitiseHref('  //evil.com  ')).toBeUndefined();
     });
   });
 
   describe('edge cases', () => {
     it('handles empty string', () => {
-      expect(isAllowedHref('')).toBe(false);
+      expect(sanitiseHref('')).toBeUndefined();
     });
 
     it('handles whitespace-padded URLs', () => {
-      expect(isAllowedHref('  https://example.com  ')).toBe(true);
+      expect(sanitiseHref('  https://example.com  ')).toBe('https://example.com');
     });
 
     it('handles whitespace-padded dangerous URLs', () => {
-      expect(isAllowedHref('  javascript:alert(1)  ')).toBe(false);
+      expect(sanitiseHref('  javascript:alert(1)  ')).toBeUndefined();
     });
   });
 
   describe('control characters in scheme — XSS bypass via URL parser throw', () => {
     it('blocks null byte mid-scheme (java\\x00script:)', () => {
-      expect(isAllowedHref('java\x00script:alert(1)')).toBe(false);
+      expect(sanitiseHref('java\x00script:alert(1)')).toBeUndefined();
     });
 
     it('blocks null byte between s and c (javas\\x00cript:)', () => {
-      expect(isAllowedHref('javas\x00cript:alert(1)')).toBe(false);
+      expect(sanitiseHref('javas\x00cript:alert(1)')).toBeUndefined();
     });
 
     it('blocks SOH prefix before javascript:', () => {
-      expect(isAllowedHref('\x01javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('\x01javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks vertical tab prefix before javascript:', () => {
-      expect(isAllowedHref('\x0Bjavascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('\x0Bjavascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks form feed prefix before javascript:', () => {
-      expect(isAllowedHref('\x0Cjavascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('\x0Cjavascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks tab mid-scheme (java\\tscript:)', () => {
-      expect(isAllowedHref('java\tscript:alert(1)')).toBe(false);
+      expect(sanitiseHref('java\tscript:alert(1)')).toBeUndefined();
     });
 
     it('blocks CRLF mid-scheme (java\\r\\nscript:)', () => {
-      expect(isAllowedHref('java\r\nscript:alert(1)')).toBe(false);
+      expect(sanitiseHref('java\r\nscript:alert(1)')).toBeUndefined();
     });
 
     it('blocks LF mid-scheme (j\\navascript:)', () => {
-      expect(isAllowedHref('j\navascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('j\navascript:alert(1)')).toBeUndefined();
     });
   });
 
   describe('zero-width and invisible character bypass', () => {
     it('blocks zero-width space prefix before javascript:', () => {
-      expect(isAllowedHref('​javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('​javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks zero-width space only (invisible link)', () => {
-      expect(isAllowedHref('​')).toBe(false);
+      expect(sanitiseHref('​')).toBeUndefined();
     });
 
     it('blocks BOM-only string (invisible link)', () => {
-      expect(isAllowedHref('')).toBe(false);
+      expect(sanitiseHref('')).toBeUndefined();
     });
 
     it('blocks BOM prefix before javascript:', () => {
-      expect(isAllowedHref('javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks zero-width non-joiner prefix before javascript:', () => {
-      expect(isAllowedHref('‌javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('‌javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks zero-width joiner prefix before javascript:', () => {
-      expect(isAllowedHref('‍javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('‍javascript:alert(1)')).toBeUndefined();
     });
   });
 
   describe('non-ASCII whitespace prefix bypass', () => {
     it('blocks NBSP prefix before javascript:', () => {
-      expect(isAllowedHref(' javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref(' javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks line separator prefix before javascript:', () => {
-      expect(isAllowedHref('\u2028javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('\u2028javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks paragraph separator prefix before javascript:', () => {
-      expect(isAllowedHref('\u2029javascript:alert(1)')).toBe(false);
+      expect(sanitiseHref('\u2029javascript:alert(1)')).toBeUndefined();
     });
 
     it('blocks NBSP before protocol-relative URL', () => {
-      expect(isAllowedHref(' //evil.com')).toBe(false);
+      expect(sanitiseHref(' //evil.com')).toBeUndefined();
     });
 
     it('blocks NBSP-only string', () => {
-      expect(isAllowedHref(' ')).toBe(false);
+      expect(sanitiseHref(' ')).toBeUndefined();
     });
   });
 
   describe('backslash-based open redirect', () => {
     it('blocks /\\evil.com (browsers normalize \\ to /)', () => {
-      expect(isAllowedHref('/\\evil.com')).toBe(false);
+      expect(sanitiseHref('/\\evil.com')).toBeUndefined();
     });
 
     it('blocks /\\\\evil.com (double backslash)', () => {
-      expect(isAllowedHref('/\\\\evil.com')).toBe(false);
+      expect(sanitiseHref('/\\\\evil.com')).toBeUndefined();
     });
 
     it('allows /path\\with\\backslash (not at position 1)', () => {
-      expect(isAllowedHref('/path\\with\\backslash')).toBe(true);
+      expect(sanitiseHref('/path\\with\\backslash')).toBeDefined();
     });
   });
 
   describe('URL-encoded dangerous schemes', () => {
     it('blocks javascript with URL-encoded colon (%3A)', () => {
-      expect(isAllowedHref('javascript%3Aalert(1)')).toBe(false);
+      expect(sanitiseHref('javascript%3Aalert(1)')).toBeUndefined();
     });
 
     it('blocks javascript with lowercase URL-encoded colon (%3a)', () => {
-      expect(isAllowedHref('javascript%3aalert(1)')).toBe(false);
+      expect(sanitiseHref('javascript%3aalert(1)')).toBeUndefined();
     });
   });
 
   describe('credential confusion / phishing via userinfo', () => {
     it('blocks https URLs with misleading userinfo (good.com@evil.com)', () => {
-      expect(isAllowedHref('https://good.com@evil.com')).toBe(false);
+      expect(sanitiseHref('https://good.com@evil.com')).toBeUndefined();
     });
 
     it('blocks https URLs with port-like credentials', () => {
-      expect(isAllowedHref('https://evil.com:443@good.com')).toBe(false);
+      expect(sanitiseHref('https://evil.com:443@good.com')).toBeUndefined();
     });
 
     it('allows https URLs without userinfo', () => {
-      expect(isAllowedHref('https://example.com/path')).toBe(true);
+      expect(sanitiseHref('https://example.com/path')).toBeDefined();
     });
 
     it('allows mailto with @ (expected in email addresses)', () => {
-      expect(isAllowedHref('mailto:user@example.com')).toBe(true);
+      expect(sanitiseHref('mailto:user@example.com')).toBeDefined();
     });
   });
 
   describe('degenerate HTTPS URLs', () => {
     it('blocks https:evil.com (no slashes — ambiguous host)', () => {
-      expect(isAllowedHref('https:evil.com')).toBe(false);
+      expect(sanitiseHref('https:evil.com')).toBeUndefined();
     });
 
     it('blocks https:/evil.com (single slash — ambiguous)', () => {
-      expect(isAllowedHref('https:/evil.com')).toBe(false);
+      expect(sanitiseHref('https:/evil.com')).toBeUndefined();
     });
 
     it('blocks https:// (no host)', () => {
-      expect(isAllowedHref('https://')).toBe(false);
+      expect(sanitiseHref('https://')).toBeUndefined();
     });
 
     it('blocks https:/// (empty host)', () => {
-      expect(isAllowedHref('https:///')).toBe(false);
+      expect(sanitiseHref('https:///')).toBeUndefined();
     });
   });
 
   describe('internal network / SSRF via allowed HTTPS', () => {
     it('blocks https://127.0.0.1 (localhost)', () => {
-      expect(isAllowedHref('https://127.0.0.1/')).toBe(false);
+      expect(sanitiseHref('https://127.0.0.1/')).toBeUndefined();
     });
 
     it('blocks https://[::1] (IPv6 localhost)', () => {
-      expect(isAllowedHref('https://[::1]/')).toBe(false);
+      expect(sanitiseHref('https://[::1]/')).toBeUndefined();
     });
 
     it('blocks hex-encoded IP (0x7f000001)', () => {
-      expect(isAllowedHref('https://0x7f000001/')).toBe(false);
+      expect(sanitiseHref('https://0x7f000001/')).toBeUndefined();
     });
 
     it('blocks decimal IP (2130706433)', () => {
-      expect(isAllowedHref('https://2130706433/')).toBe(false);
+      expect(sanitiseHref('https://2130706433/')).toBeUndefined();
     });
 
     it('blocks octal IP (0177.0.0.1)', () => {
-      expect(isAllowedHref('https://0177.0.0.1/')).toBe(false);
+      expect(sanitiseHref('https://0177.0.0.1/')).toBeUndefined();
     });
 
     it('blocks AWS metadata endpoint', () => {
-      expect(isAllowedHref('https://169.254.169.254/')).toBe(false);
+      expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined();
     });
 
     it('blocks GCP metadata endpoint', () => {
-      expect(isAllowedHref('https://metadata.google.internal/')).toBe(false);
+      expect(sanitiseHref('https://metadata.google.internal/')).toBeUndefined();
     });
 
     it('blocks localhost with trailing dot', () => {
-      expect(isAllowedHref('https://localhost./')).toBe(false);
+      expect(sanitiseHref('https://localhost./')).toBeUndefined();
     });
 
     it('blocks .internal host with trailing dot', () => {
-      expect(isAllowedHref('https://metadata.google.internal./')).toBe(false);
+      expect(sanitiseHref('https://metadata.google.internal./')).toBeUndefined();
     });
 
     it('blocks fully expanded IPv6 loopback', () => {
-      expect(isAllowedHref('https://[0:0:0:0:0:0:0:1]/')).toBe(false);
+      expect(sanitiseHref('https://[0:0:0:0:0:0:0:1]/')).toBeUndefined();
     });
   });
 
   describe('XSS payloads in fragment and path', () => {
     it('blocks XSS payload in hash fragment', () => {
-      expect(isAllowedHref('#<img onerror=alert(1)>')).toBe(false);
+      expect(sanitiseHref('#<img onerror=alert(1)>')).toBeUndefined();
     });
 
     it('blocks XSS payload in path', () => {
-      expect(isAllowedHref('/<img onerror=alert(1)>')).toBe(false);
+      expect(sanitiseHref('/<img onerror=alert(1)>')).toBeUndefined();
     });
 
     it('blocks attribute injection in hash fragment', () => {
-      expect(isAllowedHref('#" onclick="alert(1)')).toBe(false);
+      expect(sanitiseHref('#" onclick="alert(1)')).toBeUndefined();
     });
 
     it('allows normal hash fragments', () => {
-      expect(isAllowedHref('#section-1')).toBe(true);
+      expect(sanitiseHref('#section-1')).toBeDefined();
     });
 
     it('allows normal root-relative paths', () => {
-      expect(isAllowedHref('/normal/path?query=value')).toBe(true);
+      expect(sanitiseHref('/normal/path?query=value')).toBeDefined();
     });
   });
 
   describe('UNC paths (Windows network shares)', () => {
     it('blocks UNC path to external server', () => {
-      expect(isAllowedHref('\\\\evil.com\\share')).toBe(false);
+      expect(sanitiseHref('\\\\evil.com\\share')).toBeUndefined();
     });
   });
 
   describe('space before colon in scheme', () => {
     it('blocks "javascript :alert(1)" (space before colon)', () => {
-      expect(isAllowedHref('javascript :alert(1)')).toBe(false);
+      expect(sanitiseHref('javascript :alert(1)')).toBeUndefined();
     });
   });
 
   describe('mailto abuse', () => {
     it('blocks mailto with XSS in body parameter', () => {
-      expect(isAllowedHref('mailto:evil@evil.com?body=<script>alert(1)</script>')).toBe(false);
+      expect(sanitiseHref('mailto:evil@evil.com?body=<script>alert(1)</script>')).toBeUndefined();
     });
 
     it('blocks mailto with header injection (cc/bcc)', () => {
-      expect(isAllowedHref('mailto:evil@evil.com?cc=victim@good.com&bcc=spy@evil.com')).toBe(false);
+      expect(
+        sanitiseHref('mailto:evil@evil.com?cc=victim@good.com&bcc=spy@evil.com'),
+      ).toBeUndefined();
     });
 
     it('blocks mailto with no recipient (social engineering)', () => {
-      expect(isAllowedHref('mailto:?subject=urgent&body=click%20here')).toBe(false);
+      expect(sanitiseHref('mailto:?subject=urgent&body=click%20here')).toBeUndefined();
     });
 
     it('allows simple mailto with just an address', () => {
-      expect(isAllowedHref('mailto:support@example.com')).toBe(true);
+      expect(sanitiseHref('mailto:support@example.com')).toBeDefined();
     });
   });
 
   describe('additional blocked protocols (regression)', () => {
     it('blocks file: protocol', () => {
-      expect(isAllowedHref('file:///etc/passwd')).toBe(false);
+      expect(sanitiseHref('file:///etc/passwd')).toBeUndefined();
     });
 
     it('blocks ws: protocol', () => {
-      expect(isAllowedHref('ws://evil.com')).toBe(false);
+      expect(sanitiseHref('ws://evil.com')).toBeUndefined();
     });
 
     it('blocks wss: protocol', () => {
-      expect(isAllowedHref('wss://evil.com')).toBe(false);
+      expect(sanitiseHref('wss://evil.com')).toBeUndefined();
     });
 
     it('blocks blob: protocol', () => {
-      expect(isAllowedHref('blob:https://evil.com/uuid')).toBe(false);
+      expect(sanitiseHref('blob:https://evil.com/uuid')).toBeUndefined();
     });
 
     it('blocks data: with SVG XSS', () => {
-      expect(isAllowedHref('data:image/svg+xml,<svg onload=alert(1)>')).toBe(false);
+      expect(sanitiseHref('data:image/svg+xml,<svg onload=alert(1)>')).toBeUndefined();
     });
 
     it('blocks data: with base64-encoded script', () => {
-      expect(isAllowedHref('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==')).toBe(
-        false,
-      );
+      expect(
+        sanitiseHref('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='),
+      ).toBeUndefined();
     });
 
     it('blocks view-source: protocol', () => {
-      expect(isAllowedHref('view-source:https://evil.com')).toBe(false);
+      expect(sanitiseHref('view-source:https://evil.com')).toBeUndefined();
     });
 
     it('blocks custom protocol (foo:bar)', () => {
-      expect(isAllowedHref('foo:bar')).toBe(false);
+      expect(sanitiseHref('foo:bar')).toBeUndefined();
     });
 
     it('blocks minimal protocol pattern (a:b)', () => {
-      expect(isAllowedHref('a:b')).toBe(false);
+      expect(sanitiseHref('a:b')).toBeUndefined();
     });
 
     it('blocks customprotocol:payload', () => {
-      expect(isAllowedHref('customprotocol:payload')).toBe(false);
+      expect(sanitiseHref('customprotocol:payload')).toBeUndefined();
     });
   });
 
   describe('whitespace-only inputs', () => {
     it('blocks spaces only', () => {
-      expect(isAllowedHref('   ')).toBe(false);
+      expect(sanitiseHref('   ')).toBeUndefined();
     });
 
     it('blocks tab/newline/CR only', () => {
-      expect(isAllowedHref('\t\n\r')).toBe(false);
+      expect(sanitiseHref('\t\n\r')).toBeUndefined();
     });
   });
 });

package/src/Markup/utils/sanitise.ts

@@ -11,88 +11,88 @@ const IPV6_BRACKETS = /^\[|\]$/g;
 const NUMERIC_IP = /^[\d.]+$/;
 const HEX_IP = /^0x[0-9a-f]+$/i;
 
-export function isAllowedHref(href: string): boolean {
+export function sanitiseHref(href: string): string | undefined {
   const cleaned = href.replace(INVISIBLE_CHARS, '');
   const trimmed = cleaned.trim();
 
   if (!trimmed) {
-    return false;
+    return undefined;
   }
 
   if (CONTROL_CHARS.test(trimmed)) {
-    return false;
+    return undefined;
   }
 
   if (DANGEROUS_HTML_CHARS.test(trimmed)) {
-    return false;
+    return undefined;
   }
 
   if (DANGEROUS_SCHEME.test(trimmed)) {
-    return false;
+    return undefined;
   }
 
   if (ENCODED_COLON_SCHEME.test(trimmed)) {
-    return false;
+    return undefined;
   }
 
   if (trimmed.startsWith('//')) {
-    return false;
+    return undefined;
   }
 
   if (trimmed.startsWith('\\')) {
-    return false;
+    return undefined;
   }
 
   if (trimmed.startsWith('/')) {
-    return trimmed[1] !== '\\';
+    return trimmed[1] !== '\\' ? trimmed : undefined;
   }
 
   if (trimmed.startsWith('#')) {
-    return true;
+    return trimmed;
   }
 
   if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
-    return false;
+    return undefined;
   }
 
   try {
     const url = new URL(trimmed);
 
     if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return false;
+      return undefined;
     }
 
     if (url.protocol === 'https:') {
       if (!trimmed.startsWith('https://')) {
-        return false;
+        return undefined;
       }
 
       if (!url.hostname) {
-        return false;
+        return undefined;
       }
 
       if (url.username || url.password) {
-        return false;
+        return undefined;
       }
 
       if (isInternalHost(url.hostname)) {
-        return false;
+        return undefined;
       }
     }
 
     if (url.protocol === 'mailto:') {
       if (url.search) {
-        return false;
+        return undefined;
       }
 
       if (!url.pathname) {
-        return false;
+        return undefined;
       }
     }
 
-    return true;
+    return trimmed;
   } catch {
-    return false;
+    return undefined;
   }
 }
 
@@ -109,15 +109,16 @@ export function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean
     case 'all':
       return true;
     case 'internal':
-      if (href.startsWith('https://wise.com/')) return true;
-      if (href.startsWith('/')) {
-        try {
-          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;
-        } catch {
-          return false;
+      try {
+        if (!href.startsWith('/')) {
+          const parsed = new URL(href);
+          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';
         }
+        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);
+        return parsed.origin === SSR_SENTINEL_ORIGIN;
+      } catch {
+        return false;
       }
-      return false;
   }
 }