[WT-2027] Sanitize url check (#1319)

immutable · Jan 8, 2024 · 5efad06 · 5efad06
1 parent 10a79bb
commit 5efad06
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/packages/checkout/widgets-lib/src/components/Transak/useTransakEvents.ts b/packages/checkout/widgets-lib/src/components/Transak/useTransakEvents.ts
@@ -3,14 +3,15 @@ import {
 } from 'react';
 import { StandardAnalyticsActions } from '@imtbl/react-analytics';
 
+import * as url from 'url';
 import { TransakEvent, TransakEvents, TransakStatuses } from './TransakEvents';
 import {
   AnalyticsControlTypes,
   UserJourney,
   useAnalytics,
 } from '../../context/analytics-provider/SegmentAnalyticsProvider';
 
-const TRANSAK_ORIGIN = 'transak.com';
+export const TRANSAK_ORIGIN = ['global.transak.com', 'global-stg.transak.com'];
 const FAILED_TO_LOAD_TIMEOUT_IN_MS = 10000;
 
 export type TransakEventHandlers = {
@@ -147,8 +148,9 @@ export const useTransakEvents = (props: UseTransakEventsProps) => {
 
   const handleMessageEvent = useCallback(
     (event: MessageEvent) => {
+      const host = url.parse(event.origin)?.host?.toLowerCase();
       const isTransakEvent = event.source === ref?.current?.contentWindow
-        && event.origin.toLowerCase().includes(TRANSAK_ORIGIN);
+        && host && TRANSAK_ORIGIN.includes(host);
 
       if (!isTransakEvent) return;
 

diff --git a/packages/checkout/widgets-lib/src/widgets/on-ramp/views/OnRampMain.tsx b/packages/checkout/widgets-lib/src/widgets/on-ramp/views/OnRampMain.tsx
@@ -4,6 +4,7 @@ import {
   useContext, useEffect, useMemo, useState,
 } from 'react';
 import { ExchangeType } from '@imtbl/checkout-sdk';
+import url from 'url';
 import { HeaderNavigation } from '../../../components/Header/HeaderNavigation';
 import { SimpleLayout } from '../../../components/SimpleLayout/SimpleLayout';
 import { sendOnRampWidgetCloseEvent } from '../OnRampWidgetEvents';
@@ -17,9 +18,9 @@ import {
 import { TransakEventData, TransakEvents, TransakStatuses } from '../TransakEvents';
 import { ConnectLoaderContext } from '../../../context/connect-loader-context/ConnectLoaderContext';
 import { EventTargetContext } from '../../../context/event-target-context/EventTargetContext';
+import { TRANSAK_ORIGIN } from '../../../components/Transak/useTransakEvents';
 
 const transakIframeId = 'transak-iframe';
-const transakOrigin = 'transak.com';
 const IN_PROGRESS_VIEW_DELAY_MS = 1200;
 interface OnRampProps {
   showIframe: boolean;
@@ -214,8 +215,9 @@ export function OnRampMain({
     const handleTransakEvents = (event: any) => {
       if (!domIframe) return;
 
+      const host = url.parse(event.origin)?.host?.toLowerCase();
       if (event.source === domIframe.contentWindow
-        && event.origin.toLowerCase().includes(transakOrigin)) {
+        && host && TRANSAK_ORIGIN.includes(host)) {
         trackSegmentEvents(event.data, userWalletAddress, userEmail);
         transakEventHandler(event.data);
       }