Skip to content

Commit 320742c

Browse files
authored
[Fix] URL inputs to not submit numeric hostnames and url without domain (#6482)
## ISSUE (BUG) - Fixes #5396 ## Description - When given a string like **https://300**, it interprets 300 as the hostname, which it then converts to an IP address, what i did was to check if the entire string (ignoring the protocol ) is number then don't submit it all within zod and it makes sense to do that cause. - The range for valid 32-bit unsigned integers is 0 to 4294967295 (which corresponds to 0.0.0.0 to 255.255.255.255) so other than this numbers by default URL objects throws invalid. https://github.com/user-attachments/assets/1da92aeb-d50c-43a3-87ea-78a059d3fa84
1 parent 02a1da1 commit 320742c

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

packages/twenty-front/src/utils/validation-schemas/absoluteUrlSchema.ts

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,18 @@ export const absoluteUrlSchema = z
66
.or(
77
z
88
.string()
9-
.transform((value) => `https://${value}`)
9+
.transform((value) => {
10+
try {
11+
const url = `https://${value}`.trim();
12+
return isNaN(Number(value.trim())) &&
13+
new URL(url) &&
14+
/\.[a-z]{2,}$/.test(url)
15+
? url
16+
: '';
17+
} catch {
18+
return '';
19+
}
20+
})
1021
.pipe(z.string().url()),
1122
)
1223
.or(z.literal(''));

0 commit comments

Comments
 (0)