Disable redirects to non-HTTP URLs in release notes webview

sparkle-project · Jan 29, 2016 · 70f6929 · 70f6929 · chris0e3 · Feb 10, 2016
1 parent 4022b01
commit 70f6929
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/Sparkle/SUUpdateAlert.m b/Sparkle/SUUpdateAlert.m
@@ -236,8 +236,17 @@ - (void)webView:(WebView *)sender didFinishLoadForFrame:frame
 
 - (void)webView:(WebView *)__unused sender decidePolicyForNavigationAction:(NSDictionary *)__unused actionInformation request:(NSURLRequest *)request frame:(WebFrame *)__unused frame decisionListener:(id<WebPolicyDecisionListener>)listener
 {
+    NSURL *requestURL = request.URL;
+    NSString *scheme = requestURL.scheme;
+    BOOL whitelistedSafe = [@"http" isEqualToString:scheme] || [@"https" isEqualToString:scheme] || [@"about:blank" isEqualToString:requestURL.absoluteString];
+
+    // Do not allow redirects to dangerous protocols such as file://
+    if (!whitelistedSafe) {
+        [listener ignore];
+        return;
+    }
+
     if (self.webViewFinishedLoading) {
-        NSURL *requestURL = request.URL;
         if (requestURL) {
             [[NSWorkspace sharedWorkspace] openURL:requestURL];
         }