OTWO-7716 CWE-79/CWE-20: javascript: URI accepted in Homepage URL fie…

app/assets/javascripts/account_form_validation.js.coffee

@@ -0,0 +1,23 @@
+document.addEventListener 'DOMContentLoaded', ->
+  urlField = document.querySelector('input[name="account[url]"]')
+  form = document.querySelector('form[action*="/accounts/"]')
+
+  return unless urlField && form
+
+  validateUrl = (value) ->
+    return true unless value
+    /^(https?|ftp):\/\//.test(value)
+
+  updateError = ->
+    isValid = validateUrl(urlField.value)
+    urlField.classList.toggle('is-invalid', !isValid && urlField.value)
+    urlField.classList.toggle('is-valid', isValid && urlField.value)
+
+  urlField.addEventListener 'blur', updateError
+  urlField.addEventListener 'input', updateError
+
+  form.addEventListener 'submit', (e) ->
+    unless validateUrl(urlField.value)
+      e.preventDefault()
+      urlField.focus()
+      urlField.classList.add('is-invalid')

app/assets/stylesheets/account_form_validation.scss

@@ -0,0 +1,23 @@
+input.validate-url {
+  &.is-invalid {
+    border-color: #dc3545;
+    background-color: #f8d7da;
+    color: #721c24;
+
+    &:focus {
+      border-color: #c82333;
+      box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+    }
+  }
+
+  &.is-valid {
+    border-color: #28a745;
+    background-color: #d4edda;
+    color: #155724;
+
+    &:focus {
+      border-color: #1e7e34;
+      box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+    }
+  }
+}

app/models/concerns/account_validations.rb

@@ -11,7 +11,8 @@ module AccountValidations
 
     validate :valid_current_password?, on: :update, if: :validate_current_password
 
-    validates :url, length: { maximum: 100 }, url_format: true, allow_blank: true
+    validates :url, length: { maximum: 100 }, url_format: true, allow_blank: true,
+                    format: { with: %r{\A(https?|ftp)://}, message: :invalid_format, allow_blank: true }
     validates :login, presence: true
     validates :login, length: { in: 3..40 }, uniqueness: { case_sensitive: false },
                       allow_blank: false, default_param_format: true, if: :will_save_change_to_login?

app/views/accounts/_mini_header.html.haml

@@ -21,7 +21,7 @@
             %i.icon-cogs!= t '.settings'
         - unless my_account?(@account)
           = render partial: 'accounts/show/header/kudo_button', locals: { css: 'btn-minier btn-info link_space' }
-      - if @account.url.present?
+      - if @account.url.present? && @account.url.match?(%r{\A(https?|ftp)://})
         .pull-left.col-md-12.clearfix
           = link_to @account.url, target: '_blank', title: @account.url, itemprop: 'url', rel: 'nofollow noopener noreferrer' do
             %i.icon-external-link

app/views/accounts/edit.html.haml

@@ -45,8 +45,11 @@
             .form-group
               %label.control-label= t('.homepage_url')
               .controls
-                = f.text_field :url, class: 'form-control', value: @account.url
+                - valid_url = @account.url&.match?(%r{\A(https?|ftp)://}) ? @account.url : nil
+                = f.text_field :url, class: 'form-control validate-url', value: valid_url,
+                                      pattern: '(https?|ftp)://.*', title: t('accounts.edit.valid_url_format')
                 - error_tag @account, :url
+                %p.help-block= t('accounts.edit.url_format_help')
 
             .form-group
               %label.control-label= t('twitter_id')

app/views/accounts/show/_header.html.haml

@@ -22,7 +22,7 @@
         - if current_user_is_admin?
           |
           = link_to bootstrap_icon('icon-legal', t('.view_job')), admin_account_account_analysis_jobs_path(@account)
-      - if @account.url.present?
+      - if @account.url.present? && @account.url.match?(%r{\A(https?|ftp)://})
         .info
           = link_to h(@account.url), target: '_blank', title: @account.url, itemprop: 'url', rel: 'nofollow' do
             %i.icon-external-link= "  #{h(truncate(@account.url, length: 60))}".html_safe

config/locales/accounts.en.yml

@@ -1,4 +1,11 @@
 en:
+  activerecord:
+    errors:
+      models:
+        account:
+          attributes:
+            url:
+              invalid_format: 'URL must start with http://, https://, or ftp://'
   accounts:
     disabled_error: 'This account is disabled.'
     non_activated_message: Please verify your email address before making this change.
@@ -55,6 +62,8 @@ en:
       account_basics: ' : Account Basics'
       blocked_domain_error: 'contains a blocked spam pattern. Contact info@openhub.net if incorrect.'
       homepage_url: 'Homepage URL'
+      valid_url_format: 'URL must start with http://, https://, or ftp://'
+      url_format_help: 'Optional. Must be a valid URL starting with http://, https://, or ftp://'
       help_1: Your login ID will be shown in many places on Open Hub, including in lists that highlight your contributions to projects, so please choose something you want to be seen.
       help_2: Your email address is used to show your Gravitar. In addition, your email address may be used by Open Hub to match against discovered, unclaimed committer IDs on projects as a convenient way to locate your FOSS contributions. You may change your email address; we will send an activiation letter to that address for confirmation.
       help_3: Open Hub will never show your email addresses to anyone on the site or through the API.