fix: treat non-http/https login urls as invalid

npm · Feb 28, 2020 · 6bcf086 · 6bcf086
1 parent ba0373b
commit 6bcf086
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/lib/index.js b/lib/index.js
@@ -23,7 +23,7 @@ const url = require('url')
 const isValidUrl = u => {
   if (u && typeof u === 'string') {
     const p = url.parse(u)
-    return !!(p.protocol && p.slashes && p.host && p.path)
+    return p.slashes && p.host && p.path && /^https?:$/.test(p.protocol)
   }
   return false
 }

diff --git a/lib/test/#.js b/lib/test/#.js
@@ -137,7 +137,7 @@ const server = http.createServer((q, s) => {
 
       case '/invalid-login-url/-/v1/#':
         return respond(s, 200, {
-          loginUrl: 'this is not a url',
+          loginUrl: 'ftp://this.is/not-a-webpage/now/is/it?',
           doneUrl: reg + '/invalid-done/-/v1/#'
         })
 
@@ -418,7 +418,7 @@ t.test('fail at login step by having an invalid url', t => {
     method: 'POST',
     uri: reg + '/invalid-login-url/-/v1/#',
     body: {
-      loginUrl: 'this is not a url',
+      loginUrl: 'ftp://this.is/not-a-webpage/now/is/it?',
       doneUrl: reg + '/invalid-done/-/v1/#'
     },
     message: 'Invalid response from web login endpoint'