Task: Validate GoLink Destination URL Schemes on Write #350

New issue

Open

opened 2026-02-28 00:16:57 +00:00 by jjalangtry · 0 comments

jjalangtry commented

2026-02-28 00:16:57 +00:00

(Migrated from github.com)

Validate GoLink Destination URL Schemes on Write

Description

GoLink destination URLs are stored and served to users with no scheme validation. A malicious officer could create a GoLink pointing to a javascript: or data: URI, which would execute in the user's browser when followed. This must be blocked at write time.

Associated Epic: #346

Subtasks

In the golink.schema.ts Zod schema (#341), add a .refine() check: the parsed URL's protocol must be "http:" or "https:" only
Apply this validation to both POST and PUT handlers in next/app/api/golinks/route.ts
Audit existing GoLink records in the database for any non-http/https URLs before deploying
Consider adding a redirect warning page for external GoLinks (nice-to-have)

Acceptance Criteria

POST /api/golinks with url: "javascript:alert(1)" returns 400
POST /api/golinks with url: "data:text/html," returns 400
POST /api/golinks with url: "http://example.com" succeeds
POST /api/golinks with url: "https://example.com" succeeds
Existing valid GoLinks continue to redirect correctly

# Validate GoLink Destination URL Schemes on Write ## Description GoLink destination URLs are stored and served to users with no scheme validation. A malicious officer could create a GoLink pointing to a javascript: or data: URI, which would execute in the user's browser when followed. This must be blocked at write time. Associated Epic: #346 ## Subtasks - [ ] In the golink.schema.ts Zod schema (#341), add a .refine() check: the parsed URL's protocol must be "http:" or "https:" only - [ ] Apply this validation to both POST and PUT handlers in next/app/api/golinks/route.ts - [ ] Audit existing GoLink records in the database for any non-http/https URLs before deploying - [ ] Consider adding a redirect warning page for external GoLinks (nice-to-have) ## Acceptance Criteria - [ ] POST /api/golinks with url: "javascript:alert(1)" returns 400 - [ ] POST /api/golinks with url: "data:text/html,<script>alert(1)</script>" returns 400 - [ ] POST /api/golinks with url: "http://example.com" succeeds - [ ] POST /api/golinks with url: "https://example.com" succeeds - [ ] Existing valid GoLinks continue to redirect correctly