[Bug] useSignupForm.ts: communityWebsite regex allows IP addresses and internal hostnames to pass validation before https:// is prepended
@anshul23102 已经在做这个了。
开始于 2026年6月8日。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 55/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- typescript
调研方向
Start in src/features/Auth/v1/hooks/useSignupForm.ts at the communityWebsite field in signupSchema, and trace where its transformed value is consumed. Reproduce the listed IP-like and internal-hostname inputs, then verify that only safe HTTP(S) website values are accepted and private-range targets are rejected.
由索引模型根据 Issue 内容生成。
描述
Bug Summary
The communityWebsite field in signupSchema validates that the user input does not include http:// or https://, then prepends https:// in a .transform():
communityWebsite: z
.string()
.optional()
.or(z.literal(""))
.refine(
(val) => !val || /^(?!https?:\/\/)([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}(\/.*)?$/.test(val),
{ message: "Enter domain only (e.g. example.com)." }
)
.transform((val) => (val && val.trim() !== "" ? `https://${val}` : val)),
The regex ([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,} accepts:
- IP addresses with appended labels:
192.168.1.internalor169.254.169.metadatapass the regex (the part before the dot is valid, andinternal/metadataare valid TLD-like strings). - Internal hostnames:
my-server.localoradmin.lanpass the regex and are transformed tohttps://my-server.localandhttps://admin.lan. - Subdomains of attacker-controlled domains:
internal.attacker.comtrivially passes.
After .transform(), the result https://192.168.1.internal is stored as the community website. If the backend later fetches the URL for a preview (link unfurling) or renders it as a clickable link, internal network addresses could reach backend services.
Additionally, the regex requires at minimum [a-zA-Z]{2,} after the final dot, which accepts single-character country codes and invented TLDs not in any public suffix list. There is no allowlist of known TLDs.
Expected Behavior
After prepending https://, the resulting URL should be additionally validated against a safe URL allowlist (only http: and https: schemes, no private IP ranges). A simple check using new URL(transformed) and verifying hostname does not resolve to a private range would catch most cases.
Actual Behavior
Internal hostnames and IP-like addresses pass the communityWebsite regex and are stored with https:// prepended.
Affected File
src/features/Auth/v1/hooks/useSignupForm.ts, communityWebsite field.
@NexGenStudioDev I would like to work on this issue. Could you please assign/ it to me? Contributing under NSoC '26.
- 主要语言
- TypeScript
- 星标
- 7
- 派生
- 17
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
NexGenStudioDev/CommDesk 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
NexGenStudioDev/CommDesk#140 ·
-
难度 2/5 1-3 小时 新手友好度 68/100
NexGenStudioDev/CommDesk#138 ·
-
[Bug] signup.ts: uploadCommunityLogo is a simulated stub that converts files to data URLs with no size or type validation, sending multi-megabyte base64 strings in the signup payload可能重新可做 @anshul23102 于 139 天前认领，目前没有进行中的 PR。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
NexGenStudioDev/CommDesk#130 · 2 条评论 ·
-
Input text not visible in authentication forms可能重新可做 @anshul23102 于 139 天前认领，目前没有进行中的 PR。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
NexGenStudioDev/CommDesk#123 · 2 条评论 ·
-
[UX] Hardcoded window dimensions not DPI-aware — UI broken on high-DPI displays可能已有人在做 @anshul23102 于 109 天前认领。 未关闭
NexGenStudioDev/CommDesk#141 · 已指派 1 人 ·
查看 NexGenStudioDev/CommDesk 的全部 Issue
相似的 Issue
-
type: bug
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 1 天内回复
-
0️⃣ phase/new
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
-
难度 1/5 1 小时以内 新手友好度 70/100
microsoft/playwright#43640 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100