RocketChat / RocketChat/Rocket.Chat

isRelativeURL currently misclassifies several URL/path inputs in Rocket.Chat.

Open Beginner friendly
#40,313 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Current implementation:

export const isRelativeURL = (str: string): boolean => /^[^/]+/[^/].$|^/[^/].$/gim.test(str);

This causes incorrect results:

  • "test" returns false (should be treated as relative path)
  • "." returns false (should be treated as relative path)
  • "data:image/gif;base64,..." returns true (should not be treated as relative URL)

There are already TODOs in unit tests indicating this mismatch:

/C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts:8

  • /C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts:10
  • /C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts:13

This validator is used in message URL validation (validPartialURLParam), so wrong classification can affect which
values are accepted/rejected in message payload fields:

  • /C:/Users/evilt/Documents/GitHub/Rocket.Chat/apps/meteor/app/lib/server/functions/sendMessage.ts:47

Expected behavior:

  • Relative paths like test, ., ./test, ../test, /test should be handled consistently as relative.
  • Scheme-based URLs like https://..., data:..., javascript:... should not be considered relative.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with apps/meteor/tests/unit/lib/utils/isRelativeURL.spec.ts and inspect the isRelativeURL implementation, then read its use in apps/meteor/app/lib/server/functions/sendMessage.ts. Run the targeted unit test and verify that relative paths and dot paths are accepted while scheme-based URLs such as https:, data:, and javascript: are rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.