opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-05-05 00:57:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent XSS in mcp server oauth url

Browse Source
This commit is contained in:
JzoNg 2025-09-08 11:05:09 +08:00
parent 8925606f33
commit 855347caf8
1 changed files with 30 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
web/hooks/use-oauth.ts
View File

@ -13,24 +13,37 @@ export const useOAuthCallback = () => {
} }
export const openOAuthPopup = (url: string, callback: () => void) => { export const openOAuthPopup = (url: string, callback: () => void) => {
const width = 600 try {
const height = 600 const parsedUrl = new URL(url)
const left = window.screenX + (window.outerWidth - width) / 2
const top = window.screenY + (window.outerHeight - height) / 2
const popup = window.open( if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
url, console.error('Invalid URL protocol, only http: and https: are allowed')
'OAuth', return null
`width=${width},height=${height},left=${left},top=${top},scrollbars=yes`,
)
const handleMessage = (event: MessageEvent) => {
if (event.data?.type === 'oauth_callback') {
window.removeEventListener('message', handleMessage)
callback()
} }
}
window.addEventListener('message', handleMessage) const width = 600
return popup const height = 600
const left = window.screenX + (window.outerWidth - width) / 2
const top = window.screenY + (window.outerHeight - height) / 2
const popup = window.open(
parsedUrl.toString(), // 使用解析和验证后的 URL
'OAuth',
`width=${width},height=${height},left=${left},top=${top},scrollbars=yes`,
)
const handleMessage = (event: MessageEvent) => {
if (event.data?.type === 'oauth_callback') {
window.removeEventListener('message', handleMessage)
callback()
}
}
window.addEventListener('message', handleMessage)
return popup
}
catch (error) {
console.error('Invalid URL:', error)
return null
}
} }