Added sanitization for returnURL. (#1555)

package.json

@@ -62,6 +62,7 @@
         "webpack-merge": "^5.2.0"
     },
     "dependencies": {
+        "@braintree/sanitize-url": "^5.0.2",
         "@monaco-editor/loader": "^1.2.0",
         "@paperbits/azure": "0.1.468",
         "@paperbits/common": "0.1.468",

src/components/defaultAuthenticator.ts

@@ -1,9 +1,9 @@
-import { IAuthenticator, AccessToken } from "./../authentication";
 import * as Constants from "./../constants";
+import { sanitizeUrl } from "@braintree/sanitize-url";
+import { AccessToken, IAuthenticator } from "./../authentication";
 
-export class DefaultAuthenticator implements IAuthenticator {
-    constructor() { }
 
+export class DefaultAuthenticator implements IAuthenticator {
     private runSsoFlow(): Promise<void> {
         return new Promise<void>(async () => {
             const url = new URL(location.href);
@@ -20,7 +20,7 @@ export class DefaultAuthenticator implements IAuthenticator {
             await this.setAccessToken(token);
 
             // wait for redirect to happen, deliberatly not resolving the promise
-            window.location.assign(returnUrl);
+            window.location.assign(sanitizeUrl(returnUrl));
         });
     }
 

src/components/setup/setupDialog.ts

@@ -1,4 +1,5 @@
 import template from "./setupDialog.html";
+import * as Constants from "../../constants";
 import { Component, OnMounted } from "@paperbits/common/ko/decorators";
 import { ViewManager } from "@paperbits/common/ui";
 import { Router } from "@paperbits/common/routing";
@@ -21,7 +22,7 @@ export class SetupDialog {
         try {
             this.viewManager.removeShutter();
             await this.provisioningService.provision();
-            await this.router.navigateTo("/");
+            await this.router.navigateTo(Constants.pageUrlHome);
 
             window.location.reload();
         }

src/components/users/signin/ko/runtime/signin.ts

@@ -1,13 +1,14 @@
 import * as ko from "knockout";
 import * as validation from "knockout.validation";
 import template from "./signin.html";
+import { sanitizeUrl } from "@braintree/sanitize-url";
 import { EventManager } from "@paperbits/common/events";
-import { Component, RuntimeComponent, OnMounted, Param } from "@paperbits/common/ko/decorators";
-import { UsersService } from "../../../../../services/usersService";
-import { MapiError } from "../../../../../errors/mapiError";
+import { Component, OnMounted, Param, RuntimeComponent } from "@paperbits/common/ko/decorators";
+import { Router } from "@paperbits/common/routing/router";
 import { ValidationReport } from "../../../../../contracts/validationReport";
+import { MapiError } from "../../../../../errors/mapiError";
 import { RouteHelper } from "../../../../../routing/routeHelper";
-import { Router } from "@paperbits/common/routing/router";
+import { UsersService } from "../../../../../services/usersService";
 
 @RuntimeComponent({
     selector: "signin-runtime"
@@ -102,18 +103,18 @@ export class Signin {
 
         try {
             this.working(true);
-            
+
             const userId = await this.usersService.signIn(this.username(), this.password());
 
             if (userId) {
                 const clientReturnUrl = sessionStorage.getItem("returnUrl");
                 const returnUrl = this.routeHelper.getQueryParameter("returnUrl") || clientReturnUrl;
-                
+
                 if (returnUrl) {
-                    this.router.navigateTo(returnUrl);
+                    await this.router.navigateTo(sanitizeUrl(returnUrl));
                     return;
                 }
-                
+
                 this.navigateToHome();
 
                 const validationReport: ValidationReport = {
@@ -130,7 +131,7 @@ export class Signin {
                     source: "signin",
                     errors: ["Please provide a valid email and password."]
                 };
-                
+
                 this.eventManager.dispatchEvent("onValidationErrors", validationReport);
             }
         }

src/routing/signOutRouteGuard.ts

@@ -54,6 +54,6 @@ export class SignOutRouteGuard implements RouteGuard {
         }
 
         this.authenticator.clearAccessToken();
-        location.assign("/");
+        location.assign(Constants.pageUrlHome);
     }
 }

src/services/aadService.ts

@@ -1,5 +1,6 @@
 import * as Msal from "msal";
 import * as Constants from "../constants";
+import { sanitizeUrl } from "@braintree/sanitize-url";
 import { HttpClient } from "@paperbits/common/http";
 import { Router } from "@paperbits/common/routing";
 import { RouteHelper } from "../routing/routeHelper";
@@ -46,7 +47,7 @@ export class AadService {
 
         this.router.getCurrentUrl() === returnUrl
             ? location.reload()
-            : await this.router.navigateTo(returnUrl);
+            : await this.router.navigateTo(sanitizeUrl(returnUrl));
     }
 
     /**

src/services/provisioningService.ts

@@ -70,7 +70,7 @@ export class ProvisionService {
                     throw new Error("Unable to setup website.");
                 }
             }
-            this.router.navigateTo("/");
+            this.router.navigateTo(Constants.pageUrlHome);
             this.viewManager.setHost({ name: "page-host" });
             this.viewManager.showToolboxes();
         }