validate url

Author: swathi2006

src/components/SupportUsButton.tsx

@@ -48,6 +48,16 @@ function getButtonClasses(buttonVariant: ButtonVariant): string {
   return `${base} bg-primary hover:bg-primary/90 text-black font-black py-4 transition-all active:scale-[0.98] shadow-lg shadow-primary/20`;
 }
 
+// Helper function to validate URLs and prevent XSS through 'javascript:' protocol
+function validateUrl(url?: string): string | undefined {
+  if (!url) return undefined;
+  const lowerUrl = url.toLowerCase();
+  if (lowerUrl.startsWith("http://") || lowerUrl.startsWith("https://")) {
+    return url;
+  }
+  return undefined;
+}
+
 // Main component function that renders the support us button, taking in various props for customization and rendering different sections such as hero, organization information, sponsors, and call-to-action based on the provided data and selected theme and button variant
 function SupportUsButton({
   Theme = "AOSSIE",
@@ -193,9 +203,9 @@ function SupportUsButton({
             </div>
 
             {/* Visit Organization Button */}
-            {organizationInformation.url && (
+            {validateUrl(organizationInformation.url) && (
               <a
-                href={organizationInformation.url}
+                href={validateUrl(organizationInformation.url)}
                 target="_blank"
                 rel="noopener noreferrer"
                 title={`Visit ${organizationInformation.name}'s website`}
@@ -309,7 +319,7 @@ function SupportUsButton({
             <div className="flex flex-row flex-wrap justify-center items-center gap-10 z-10">
               {sponsors.map((sponsor, index) => (
                 <a
-                  href={sponsor.link}
+                  href={validateUrl(sponsor.link)}
                   key={index}
                   target="_blank"
                   rel="noopener noreferrer"
@@ -452,7 +462,7 @@ function SupportUsButton({
           <div className="flex flex-wrap justify-center items-center gap-5 mt-8">
             {ctaSection.sponsorLink.map((link, index) => (
               <a
-                href={link.url}
+                href={validateUrl(link.url)}
                 key={index}
                 {...(link.newTab && { target: "_blank" })}
                 rel="noopener noreferrer"