Only allow https call links to be passed through the custom app scheme

This commit is contained in:
Stefan Ceriu
2023-09-25 09:17:44 +03:00
parent de6bedb0cd
commit f073db93db

View File

@@ -91,7 +91,9 @@ struct ElementCallURLParser: URLParser {
}
guard let encodedURLString = components.queryItems?.first(where: { $0.name == customSchemeURLQueryParameterName })?.value,
let callURL = URL(string: encodedURLString) else {
let callURL = URL(string: encodedURLString),
callURL.scheme == "https" // Don't allow URLs from potentially unsafe domains
else {
MXLog.error("Invalid custom scheme call parameters: \(url)")
return nil
}