refactor: replace validateURL with isValidTokenListSource for URL validation

Author: kernelwhisperer

apps/cowswap-frontend/src/modules/tokensList/containers/ManageListsAndTokens/index.tsx

@@ -1,7 +1,7 @@
 import { ReactNode, useMemo, useState } from 'react'
 
 import { TokenWithLogo } from '@cowprotocol/common-const'
-import { isAddress, parseENSAddress, uriToHttp } from '@cowprotocol/common-utils'
+import { isAddress, isValidTokenListSource } from '@cowprotocol/common-utils'
 import { ListState, useSearchList, useSearchToken } from '@cowprotocol/tokens'
 import { ModalHeader } from '@cowprotocol/ui'
 
@@ -44,14 +44,7 @@ export function ManageListsAndTokens(props: ManageListsAndTokensProps): ReactNod
   const isListUrlValid = useMemo(() => {
     if (!listInput) return false
 
-    const value = listInput.trim()
-
-    if (parseENSAddress(value)) return true
-
-    const protocol = value.split(':')[0]?.toLowerCase()
-    if (protocol !== 'http' && protocol !== 'https') return false
-
-    return uriToHttp(value).length > 0
+    return isValidTokenListSource(listInput)
   }, [listInput])
 
   const tokenSearchResponse = useSearchToken(isTokenAddressValid ? tokenInput : null)

apps/widget-configurator/src/app/configurator/controls/AddCustomListDialog.tsx

@@ -1,5 +1,6 @@
 import React, { ReactNode, useEffect, useRef, useState } from 'react'
 
+import { isValidTokenListSource } from '@cowprotocol/common-utils'
 import { Command, TokenInfo } from '@cowprotocol/types'
 
 import {
@@ -17,7 +18,6 @@ import Tabs from '@mui/material/Tabs'
 
 import { DEFAULT_CUSTOM_TOKENS } from '../consts'
 import { parseCustomTokensInput } from '../utils/parseCustomTokensInput'
-import { validateURL } from '../utils/validateURL'
 
 const jsonTextAreaStyles = {
   fontFamily: 'monospace',
@@ -80,7 +80,7 @@ export function AddCustomListDialog({
 
     setCustomListUrl(value)
 
-    setHasErrors(value ? !validateURL(value) : false)
+    setHasErrors(value ? !isValidTokenListSource(value) : false)
   }
 
   // TODO: Add proper return type annotation

apps/widget-configurator/src/app/configurator/utils/validateURL.test.ts

@@ -36,6 +36,7 @@ export * from './isInjectedWidget'
 export * from './isIframe'
 export * from './isSellOrder'
 export * from './isSupportedChainId'
+export * from './isValidTokenListSource'
 export * from './isZero'
 export * from './jotai/atomWithPartialUpdate'
 export * from './legacyAddressUtils'

apps/widget-configurator/src/app/configurator/utils/validateURL.ts

@@ -0,0 +1,28 @@
+import { isValidTokenListSource } from './isValidTokenListSource'
+
+describe('isValidTokenListSource', () => {
+  it('accepts http and https URLs', () => {
+    expect(isValidTokenListSource('http://example.com/list.json')).toBe(true)
+    expect(isValidTokenListSource('https://example.com/list.json')).toBe(true)
+  })
+
+  it('accepts uriToHttp-supported protocols and ENS sources', () => {
+    expect(isValidTokenListSource('data:application/json,{}')).toBe(true)
+    expect(isValidTokenListSource('/@fs/etc/passwd')).toBe(true)
+    expect(isValidTokenListSource('ipfs://QmHash')).toBe(true)
+    expect(isValidTokenListSource('ipns://tokens.uniswap.org')).toBe(true)
+    expect(isValidTokenListSource('ar://hash')).toBe(true)
+    expect(isValidTokenListSource('tokens.uniswap.eth')).toBe(true)
+    expect(isValidTokenListSource('tokens.uniswap.eth/list.json')).toBe(true)
+  })
+
+  it('rejects unsafe or unsupported sources', () => {
+    expect(isValidTokenListSource('')).toBe(false)
+    expect(isValidTokenListSource('  https://example.com/list.json  ')).toBe(false)
+    expect(isValidTokenListSource('\tipfs://QmHash\n')).toBe(false)
+    expect(isValidTokenListSource('ftp://example.com/list.json')).toBe(false)
+    expect(isValidTokenListSource('file:///tmp/list.json')).toBe(false)
+    expect(isValidTokenListSource('javascript:alert(1)')).toBe(false)
+    expect(isValidTokenListSource('blob:https://example.com/id')).toBe(false)
+  })
+})

libs/common-utils/src/index.ts

@@ -0,0 +1,6 @@
+import { parseENSAddress } from './parseENSAddress'
+import { uriToHttp } from './uriToHttp'
+
+export function isValidTokenListSource(source: string): boolean {
+  return uriToHttp(source).length > 0 || Boolean(parseENSAddress(source))
+}