Resolve relative Scratch.canEmbed() URLs before sending to security m…

…anager
TurboWarp · Dec 4, 2023 · c9f93b9 · c9f93b9
1 parent b90d1bc
commit c9f93b9
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 1 deletion.
diff --git a/src/extension-support/tw-unsandboxed-extension-runner.js b/src/extension-support/tw-unsandboxed-extension-runner.js
@@ -85,7 +85,13 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
 
     Scratch.canGeolocate = async () => vm.securityManager.canGeolocate();
 
-    Scratch.canEmbed = async url => vm.securityManager.canEmbed(url);
+    Scratch.canEmbed = async url => {
+        const parsed = parseURL(url);
+        if (!parsed) {
+            return false;
+        }
+        return vm.securityManager.canEmbed(parsed.href);
+    };
 
     Scratch.fetch = async (url, options) => {
         const actualURL = url instanceof Request ? url.url : url;

diff --git a/test/integration/tw_security_manager.js b/test/integration/tw_security_manager.js
@@ -236,3 +236,32 @@ test('canRedirect', async t => {
 
     t.end();
 });
+
+test('canEmbed', async t => {
+    const vm = new VirtualMachine();
+    setupUnsandboxedExtensionAPI(vm);
+    global.location = {
+        href: 'https://example.com/'
+    };
+
+    const calledWithURLs = [];
+    vm.securityManager.canEmbed = async url => {
+        calledWithURLs.push(url);
+        return url === 'https://example.com/ok';
+    };
+
+    t.equal(await global.Scratch.canEmbed('https://example.com/ok'), true);
+    t.equal(await global.Scratch.canEmbed('https://example.com/bad'), false);
+    t.equal(await global.Scratch.canEmbed('file:///etc/hosts'), false);
+    t.equal(await global.Scratch.canEmbed('data:text/html;,<h1>test</h1>'), false);
+    t.equal(await global.Scratch.canEmbed('ok'), true);
+    t.same(calledWithURLs, [
+        'https://example.com/ok',
+        'https://example.com/bad',
+        'file:///etc/hosts',
+        'data:text/html;,<h1>test</h1>',
+        'https://example.com/ok'
+    ]);
+
+    t.end();
+});