RocketChat / RocketChat/Rocket.Chat
isRelativeURL currently misclassifies several URL/path inputs in Rocket.Chat.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Current implementation:
export const isRelativeURL = (str: string): boolean => /^[^/]+/[^/].$|^/[^/].$/gim.test(str);
This causes incorrect results:
- "test" returns false (should be treated as relative path)
- "." returns false (should be treated as relative path)
- "data:image/gif;base64,..." returns true (should not be treated as relative URL)
There are already TODOs in unit tests indicating this mismatch:
/C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts:8
- /C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts:10
- /C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts:13
This validator is used in message URL validation (validPartialURLParam), so wrong classification can affect which
values are accepted/rejected in message payload fields:
- /C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/app/lib/server/functions/sendMessage.ts:47
Expected behavior:
- Relative paths like test, ., ./test, ../test, /test should be handled consistently as relative.
- Scheme-based URLs like https://..., data:..., javascript:... should not be considered relative.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts and inspect the isRelativeURL implementation, then read its use in apps/meteor/app/lib/server/functions/sendMessage.ts. Run the targeted unit test and verify that relative paths and dot paths are accepted while scheme-based URLs such as https:, data:, and javascript: are rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100