Skip to content

Unsafe split of api endpoint in instance domains #1447

@Fastbuilder575

Description

@Fastbuilder575

api: Config.get().api.endpointPublic?.split("/api")[0] || "", // Transitional, see /.well-known/spacebar/client

The split is not safe as, for example, it splits https://api.example.com/api/v9 to https:/

Quick and dirty fix, add a trailing /:

api: Config.get().api.endpointPublic?.split("/api/")[0] || "", // Transitional, see /.well-known/spacebar/client

Better fix:

Use the url.origin function to get the base url:

Not sure if config.get() is needed because its not used in all variables there.

If yes:
api: Config.get().api.endpointPublic ? new URL(Config.get().api.endpointPublic).origin : "", // Transitional, see /.well-known/spacebar/client

If not:
api: api.endpointPublic ? new URL(.api.endpointPublic).origin : "", // Transitional, see /.well-known/spacebar/client

I know that its transitional but it still should be correct :)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions