Merge pull request #442 from DEEIX-AI/fix

fix: Add logo URL validation and update dompurify version

Author: chenyme

backend/internal/application/auth/provider.go

@@ -598,13 +598,8 @@ func (s *Service) normalizeProviderInput(input UpsertIdentityProviderInput, curr
 		return nil, ErrIdentityProviderSuperAdminDefaultRoleNotAllowed
 	}
 	logoURL := strings.TrimSpace(input.LogoURL)
-	if logoURL != "" {
-		parsedLogoURL, err := url.Parse(logoURL)
-		isHTTPLogoURL := (parsedLogoURL.Scheme == "http" || parsedLogoURL.Scheme == "https") && parsedLogoURL.Host != ""
-		isAbsolutePathLogoURL := strings.HasPrefix(logoURL, "/")
-		if err != nil || (!isHTTPLogoURL && !isAbsolutePathLogoURL) {
-			return nil, fmt.Errorf("logo url must be a valid http(s) or absolute path")
-		}
+	if logoURL != "" && !isValidProviderLogoURL(logoURL) {
+		return nil, fmt.Errorf("logo url must be a valid http(s) or absolute path")
 	}
 	provider := &domainuser.IdentityProvider{
 		Type:                providerType,
@@ -660,6 +655,21 @@ func (s *Service) normalizeProviderInput(input UpsertIdentityProviderInput, curr
 	return provider, nil
 }
 
+func isValidProviderLogoURL(value string) bool {
+	parsedLogoURL, err := url.Parse(value)
+	if err != nil {
+		return false
+	}
+	if (parsedLogoURL.Scheme == "http" || parsedLogoURL.Scheme == "https") && parsedLogoURL.Host != "" {
+		return true
+	}
+	return parsedLogoURL.Scheme == "" &&
+		parsedLogoURL.Host == "" &&
+		strings.HasPrefix(value, "/") &&
+		!strings.HasPrefix(value, "//") &&
+		!strings.Contains(value, "\\")
+}
+
 func toProviderViews(items []domainuser.IdentityProvider, includeSensitive bool) []IdentityProviderView {
 	results := make([]IdentityProviderView, 0, len(items))
 	for _, item := range items {

backend/internal/application/auth/provider_test.go

@@ -90,6 +90,47 @@ func TestNormalizeProviderInputProtectsSuperAdminDefaultRole(t *testing.T) {
 	}
 }
 
+func TestNormalizeProviderInputValidatesLogoURL(t *testing.T) {
+	service := NewService(config.Config{JWTSecret: "test-secret"}, &providerLoginRepo{}, nil)
+
+	cases := []struct {
+		name    string
+		logoURL string
+		wantErr bool
+	}{
+		{name: "https url", logoURL: "https://example.com/logo.svg"},
+		{name: "http url", logoURL: "http://example.com/logo.svg"},
+		{name: "absolute path", logoURL: "/identity-providers/acme.svg"},
+		{name: "protocol relative url", logoURL: "//example.com/logo.svg", wantErr: true},
+		{name: "data url", logoURL: "data:image/svg+xml,<svg/>", wantErr: true},
+		{name: "javascript url", logoURL: "javascript:alert(1)", wantErr: true},
+		{name: "relative path", logoURL: "identity-providers/acme.svg", wantErr: true},
+		{name: "backslash path", logoURL: `/\example.svg`, wantErr: true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := service.normalizeProviderInput(UpsertIdentityProviderInput{
+				ActorRole:           domainuser.RoleAdmin,
+				Type:                domainuser.IdentityProviderTypeOIDC,
+				Name:                "Acme SSO",
+				LogoURL:             tc.logoURL,
+				ClientID:            "client",
+				ClientSecret:        "secret",
+				DiscoveryURL:        "https://example.com/.well-known/openid-configuration",
+				RegistrationEnabled: boolPtr(true),
+				DefaultRole:         domainuser.RoleUser,
+			}, nil)
+			if tc.wantErr && err == nil {
+				t.Fatalf("expected logo URL %q to be rejected", tc.logoURL)
+			}
+			if !tc.wantErr && err != nil {
+				t.Fatalf("expected logo URL %q to be accepted, got %v", tc.logoURL, err)
+			}
+		})
+	}
+}
+
 func TestResolveProviderUserAutoRegistrationAddsUsernameSuffixOnCollision(t *testing.T) {
 	repo := &providerLoginRepo{duplicateUsernameAttempts: 1}
 	service := NewService(config.Config{JWTSecret: "test-secret"}, repo, nil)

frontend/package.json

@@ -8,7 +8,7 @@
       "@babel/core": "7.29.7",
       "brace-expansion@1": "1.1.15",
       "brace-expansion@5": "5.0.6",
-      "dompurify": "3.4.10",
+      "dompurify": "3.4.11",
       "flatted": "3.4.2",
       "js-yaml": "4.2.0",
       "mermaid": "11.15.0",

frontend/pnpm-lock.yaml

@@ -17,7 +17,10 @@ function resolveCustomIdentityProviderLogoURL(logoURL: string | undefined, slug:
   if (/^https?:\/\//i.test(trimmed)) {
     return `/api/v1/auth/providers/${encodeURIComponent(slug)}/logo`;
   }
-  return trimmed;
+  if (trimmed.startsWith("/") && !trimmed.startsWith("//") && !trimmed.includes("\\")) {
+    return trimmed;
+  }
+  return "";
 }
 
 export function IdentityProviderIcon({