Only allow https call links to be passed through the custom app scheme
This commit is contained in:
@@ -91,7 +91,9 @@ struct ElementCallURLParser: URLParser {
|
||||
}
|
||||
|
||||
guard let encodedURLString = components.queryItems?.first(where: { $0.name == customSchemeURLQueryParameterName })?.value,
|
||||
let callURL = URL(string: encodedURLString) else {
|
||||
let callURL = URL(string: encodedURLString),
|
||||
callURL.scheme == "https" // Don't allow URLs from potentially unsafe domains
|
||||
else {
|
||||
MXLog.error("Invalid custom scheme call parameters: \(url)")
|
||||
return nil
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user