feat(App): Add security checks for external URLs

1 files changed, 15 insertions, 0 deletions

diff --git a/src/helpers/url-helpers.js b/src/helpers/url-helpers.js
new file mode 100644
index 000000000..750d1f00c
--- /dev/null
+++ b/src/helpers/url-helpers.js
@@ -0,0 +1,15 @@
+import { URL } from 'url';
+
+import { ALLOWED_PROTOCOLS } from '../config';
+
+const debug = require('debug')('Franz:Helpers:url');
+
+export function isValidExternalURL(url) {
+  const parsedUrl = new URL(url);
+
+  const isAllowed = ALLOWED_PROTOCOLS.includes(parsedUrl.protocol);
+
+  debug('protocol check is', isAllowed, 'for:', url);
+
+  return isAllowed;
+}