@vertesia/ui 1.6.0-dev.20261014.015055Z → 1.6.0-dev.20261022.120426Z

package/src/session/auth/oauth.ts

@@ -6,6 +6,7 @@ import { markCentralAuthRoundTripStarted } from './authRoundTrip';
 import { verifyAuthState } from './authState';
 import { usesGatewaySession } from './gateway';
 import { isStsTokenIssuer } from './tokenIssuer';
+import { isLoopbackHostname } from './vertesiaHosts';
 
 const TRANSACTION_KEY = 'vertesia.oauth.transaction';
 const TOKEN_KEY = 'vertesia.oauth.access';
@@ -55,9 +56,13 @@ function base64url(bytes: Uint8Array): string {
 function randomValue(): string {
     return base64url(crypto.getRandomValues(new Uint8Array(32)));
 }
-function httpsUrl(value: string): URL {
+/** Validate a public protocol endpoint URL. The returned URL is routing metadata, not a credential. */
+function validatedEndpointUrl(value: string): URL {
     const url = new URL(value);
-    if (url.protocol !== 'https:' || url.username || url.password) throw new Error('OAuth endpoint must use HTTPS');
+    const localHttp = Env.isLocalDev && url.protocol === 'http:' && isLoopbackHostname(url.hostname);
+    if ((url.protocol !== 'https:' && !localHttp) || url.username || url.password) {
+        throw new Error('OAuth endpoint must use HTTPS or local-development loopback HTTP');
+    }
     return url;
 }
 
@@ -97,11 +102,13 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     }
     const redirectUri = redirect.toString();
     if (new URL(redirectUri).origin !== window.location.origin) throw new Error('OAuth callback must be same-origin');
-    const issuer = (config.issuer ? httpsUrl(config.issuer).toString() : Env.endpoints.sts).replace(/\/+$/, '');
+    const issuer = validatedEndpointUrl(config.issuer ?? Env.endpoints.sts)
+        .toString()
+        .replace(/\/+$/, '');
     // A token is issued for one audience. The default audience follows the issuer, which is already part of every
     // stored credential's identity; a configured one is recorded alongside it, so changing it never reuses a token,
     // refresh session or login transaction issued for the previous audience.
-    const configuredResource = config.resource ? httpsUrl(config.resource).toString() : undefined;
+    const configuredResource = config.resource ? validatedEndpointUrl(config.resource).toString() : undefined;
     const sameClient = (stored: { clientId: string; issuer: string; resource?: string }) =>
         stored.clientId === clientId && stored.issuer === issuer && stored.resource === configuredResource;
     let current = new URL(window.location.href);
@@ -184,10 +191,12 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         revocation_endpoint?: string;
     } = await discovery.json();
     if (metadata.issuer.replace(/\/+$/, '') !== issuer) throw new Error('OAuth issuer mismatch');
-    const authorize = httpsUrl(metadata.authorization_endpoint);
-    const tokenEndpoint = httpsUrl(metadata.token_endpoint);
+    const authorize = validatedEndpointUrl(metadata.authorization_endpoint);
+    const tokenEndpoint = validatedEndpointUrl(metadata.token_endpoint);
     const revocationEndpoint =
-        metadata.revocation_endpoint === undefined ? undefined : httpsUrl(metadata.revocation_endpoint).toString();
+        metadata.revocation_endpoint === undefined
+            ? undefined
+            : validatedEndpointUrl(metadata.revocation_endpoint).toString();
     const resource = configuredResource ?? new URL(metadata.issuer).toString();
     if (refreshCredential) {
         try {
@@ -299,7 +308,7 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     }
     let scopes = config.scopes ?? ['openid', 'profile'];
     if (clientId.startsWith('https://')) {
-        const documentResponse = await fetch(httpsUrl(clientId), { cache: 'no-store' });
+        const documentResponse = await fetch(validatedEndpointUrl(clientId), { cache: 'no-store' });
         if (!documentResponse.ok) throw new Error(`Application CIMD unavailable (${documentResponse.status})`);
         const document: { scope?: string; redirect_uris?: string[] } = await documentResponse.json();
         if (!document.redirect_uris?.includes(redirectUri))
@@ -368,7 +377,7 @@ export async function revokeAppOAuthSession(): Promise<void> {
     const cached = refreshSession;
     clearAppOAuth();
     if (!cached) return;
-    const revoke = httpsUrl(cached.revocationEndpoint ?? cached.tokenEndpoint);
+    const revoke = validatedEndpointUrl(cached.revocationEndpoint ?? cached.tokenEndpoint);
     if (cached.revocationEndpoint === undefined) revoke.pathname = revoke.pathname.replace(/\/token$/, '/revoke');
     await fetch(revoke, {
         method: 'POST',

package/src/widgets/markdown/MermaidDiagram.tsx

@@ -92,7 +92,10 @@ function loadMermaid(): Promise<Mermaid> {
             mermaid.initialize({
                 startOnLoad: false,
                 theme: 'default',
-                securityLevel: 'loose',
+                // Diagram source comes from LLM output and documents, so it is untrusted. 'strict' makes Mermaid
+                // sanitize the whole SVG with DOMPurify, drop `javascript:` link targets and ignore click callbacks;
+                // 'loose' let `click A href "javascript:…"` through to the page.
+                securityLevel: 'strict',
                 fontFamily: MERMAID_FONT_FAMILY,
                 suppressErrorRendering: true,
                 flowchart: {
@@ -202,7 +205,7 @@ export function MermaidDiagram({ code, className }: MermaidDiagramProps) {
         <div
             ref={containerRef}
             className={`my-4 w-full overflow-x-auto [&_svg]:mx-auto [&_svg]:w-full [&_svg]:h-auto [&_svg]:max-w-full ${className || ''}`}
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: SVG is produced by Mermaid renderer from a known mermaid-source string
+            // biome-ignore lint/security/noDangerouslySetInnerHtml: Mermaid sanitizes its SVG output under securityLevel 'strict'
             dangerouslySetInnerHTML={{ __html: svg }}
         />
     );

package/src/widgets/upload/DropZone.tsx

@@ -94,6 +94,7 @@ export function DropZone({ onDrop, message, buttonLabel, allowFolders = true, cl
 
     const handleDrop = async (e: React.DragEvent) => {
         e.preventDefault();
+        e.stopPropagation();
         setIsDragging(false);
 
         if (e.dataTransfer.items && e.dataTransfer.items.length > 0) {