feat(security): add domain allowlist to sanitizeUrl and sanitizeHtml#844
Merged
RUKAYAT-CODER merged 2 commits intoJun 29, 2026
Merged
Conversation
Extends sanitizeUrl() to validate the URL hostname against ALLOWED_LINK_DOMAINS in addition to the existing protocol check. Adds a DOMPurify afterSanitizeAttributes hook that strips href attributes pointing to non-allowlisted absolute URLs, while keeping relative URLs (same-origin) intact. Adds 34 tests covering allowed domains, disallowed domains, data/javascript URIs, relative URLs, and edge cases.
|
@Ajibose Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
RUKAYAT-CODER
approved these changes
Jun 29, 2026
RUKAYAT-CODER
left a comment
RUKAYAT-CODER
left a comment
Contributor
There was a problem hiding this comment.
Thank you for contributing to the project.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #728
Summary
ALLOWED_LINK_DOMAINSconfig array tosrc/constants/app.constants.tswith safe default domains (teachlink.com,youtube.com,youtube-nocookie.com,vimeo.com,github.com,loom.com)sanitizeUrl()to validate the URL hostname against the allowlist in addition to the existing protocol check — disallowed domains returnnullafterSanitizeAttributeshook that stripshrefattributes pointing to non-allowlisted absolute URLs; relative URLs (same-origin) are preserveddata:andjavascript:URIs are blocked at the protocol level in bothsanitizeUrl()and the DOMPurify hookTest plan
sanitizeUrl()(teachlink.com, youtube.com, youtube-nocookie.com, subdomains)nullfromsanitizeUrl()(evil.com, lookalike domains)javascript:,data:,vbscript:,ftp:URIs are blockednullsanitizeHtml()keeps hrefs for allowed domainssanitizeHtml()strips hrefs for disallowed domains while preserving link textsanitizeHtml()keeps relative hrefs (/about,#section)npx vitest run src/utils/__tests__/sanitize.test.ts