[mzner]

validate .psec URL before opening

Description

Related Issue

• Fixes https://kiteworks.atlassian.net/browse/OCISDEV-1016

Motivation and Context

How Has This Been Tested?

• test environment:
• test case 1:
• test case 2:
• ...

Screenshots (if appropriate):

Open tasks:

• ...

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[DeepDiver1975]

Solid security fix; one blocking defect (the changelog) that's already failing CI.

Validation is correct. Scheme allowlist (https:/http:) + URL.origin comparison is the right approach — origin covers scheme+host+port, and new URL() normalization means no whitespace/case bypass. Blocks javascript:/data:/blob: and wrong-origin URLs at the render-time iframe src gate in FolderViewModal.vue, which is the layer that actually matters. Defense-in-depth across write (useCreateFileHandler) / read (useOpenFolderAction) / render is good, and tests cover all three layers plus the malicious-scheme and wrong-origin cases.

Blocking — changelog URL is malformed (this is why Generate Changelog is red):

• calens fails with bugfix-validate-psec-url.md: primary issue ID not found. https://github.com/owncloud/web/issues/OCISDEV-1016 is a Jira ID, not a GitHub issue — that URL 404s and calens can't parse a primary ID from it. Per changelog/TEMPLATE, with no GitHub issue the primary ID is the PR. Fix: replace it with https://github.com/owncloud/web/pull/13924 (keep the Jira link in the PR body, not the fragment).

Minor (non-blocking):

• FolderViewModal.vue throws synchronously in <script setup>. The useOpenFolderAction read-time guard already rejects bad URLs before the modal mounts, so the component throw is unreachable belt-and-suspenders — fine as a backstop, but it would surface as an uncaught render error rather than graceful handling if ever reached.
• sandbox="allow-scripts allow-same-origin ...": the allow-scripts + allow-same-origin combination lets framed content remove its own sandbox. Acceptable here since origin is already validated to the configured server, but worth a code comment noting the intent is hardening, not isolation.

CI: Generate Changelog failing (changelog URL, above), build pending, rest green. mergeStateStatus: BLOCKED.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[DeepDiver1975]

Re-review (delta only): blocker cleared, LGTM.

• Changelog fixed — fragment now cites https://github.com/owncloud/web/pull/13924 (was the Jira ID OCISDEV-1016). Generate Changelog CI is green.
• Validation strengthened beyond the prior round: origin check (url.origin === configStore.serverUrl origin) added on top of the scheme check, and validation now happens early in useOpenFolderAction/useCreateFileHandler with i18n'd errors — FolderViewModal's throw is now a backstop, not the sole guard. Good.
• Tests cover scheme (javascript:/data:/blob:) and cross-origin rejection across all three paths.

Security fix sound, blocker resolved. Not approving/merging — leaving the merge call to maintainers.

🤖 Generated with Claude Code