From aece6c57d24b2f24daba70b122f02d6def41563c Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Sat, 11 Feb 2023 10:54:25 +0100
Subject: [PATCH] catalog-model: improve location reference validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Fredrik Adelöw <freben@gmail.com>
---
 .changeset/purple-panthers-know.md              |  5 +++++
 .../catalog-model/src/location/helpers.test.ts  |  9 +++++++++
 packages/catalog-model/src/location/helpers.ts  | 17 +++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 .changeset/purple-panthers-know.md

diff --git a/.changeset/purple-panthers-know.md b/.changeset/purple-panthers-know.md
new file mode 100644
index 0000000000..c53c6d8890
--- /dev/null
+++ b/.changeset/purple-panthers-know.md
@@ -0,0 +1,5 @@
+---
+'@backstage/catalog-model': patch
+---
+
+Add additional validation for location references.
diff --git a/packages/catalog-model/src/location/helpers.test.ts b/packages/catalog-model/src/location/helpers.test.ts
index 91a2137611..28267dcf37 100644
--- a/packages/catalog-model/src/location/helpers.test.ts
+++ b/packages/catalog-model/src/location/helpers.test.ts
@@ -50,6 +50,9 @@ describe('parseLocationRef', () => {
     expect(() => parseLocationRef('https://bleh')).toThrow(
       "Invalid location ref 'https://bleh', please prefix it with 'url:', e.g. 'url:https://bleh'",
     );
+    expect(() => parseLocationRef('url:javascript:alert()')).toThrow(
+      "Invalid location ref 'url:javascript:alert()', target is a javascript: URL",
+    );
   });
 });
 
@@ -70,6 +73,12 @@ describe('stringifyLocationRef', () => {
     expect(() => stringifyLocationRef({ type: 'hello', target: '' })).toThrow(
       'Unable to stringify location ref, empty target',
     );
+    expect(() =>
+      // eslint-disable-next-line no-script-url
+      stringifyLocationRef({ type: 'url', target: 'javascript:alert()' }),
+    ).toThrow(
+      "Invalid location ref 'url:javascript:alert()', target is a javascript: URL",
+    );
   });
 });
 
diff --git a/packages/catalog-model/src/location/helpers.ts b/packages/catalog-model/src/location/helpers.ts
index 6f9800c5a2..a2f4d84f6f 100644
--- a/packages/catalog-model/src/location/helpers.ts
+++ b/packages/catalog-model/src/location/helpers.ts
@@ -17,6 +17,11 @@
 import { Entity, stringifyEntityRef } from '../entity';
 import { ANNOTATION_LOCATION, ANNOTATION_SOURCE_LOCATION } from './annotation';
 
+// See https://github.com/facebook/react/blob/f0cf832e1d0c8544c36aa8b310960885a11a847c/packages/react-dom-bindings/src/shared/sanitizeURL.js
+const scriptProtocolPattern =
+  // eslint-disable-next-line no-control-regex
+  /^[\u0000-\u001F ]*j[\r\n\t]*a[\r\n\t]*v[\r\n\t]*a[\r\n\t]*s[\r\n\t]*c[\r\n\t]*r[\r\n\t]*i[\r\n\t]*p[\r\n\t]*t[\r\n\t]*\:/i;
+
 /**
  * Parses a string form location reference.
  *
@@ -56,6 +61,12 @@ export function parseLocationRef(ref: string): {
     );
   }
 
+  if (scriptProtocolPattern.test(target)) {
+    throw new TypeError(
+      `Invalid location ref '${ref}', target is a javascript: URL`,
+    );
+  }
+
   return { type, target };
 }
 
@@ -78,6 +89,12 @@ export function stringifyLocationRef(ref: {
     throw new TypeError(`Unable to stringify location ref, empty target`);
   }
 
+  if (scriptProtocolPattern.test(target)) {
+    throw new TypeError(
+      `Invalid location ref '${type}:${target}', target is a javascript: URL`,
+    );
+  }
+
   return `${type}:${target}`;
 }