Merge pull request #735 from microsoft/sandy081/horrible-rat

fix: validate sponsor URL
microsoft · Jun 1, 2022 · 95823b6 · 95823b6
2 parents 2ec05b1 + 75456f2
commit 95823b6
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 6 deletions.
diff --git a/src/manifest.ts b/src/manifest.ts
@@ -60,7 +60,7 @@ export interface Manifest {
 	enabledApiProposals?: readonly string[];
 	qna?: 'marketplace' | string | false;
 	extensionKind?: ExtensionKind | ExtensionKind[];
-	sponsor?: string;
+	sponsor?: { url: string };
 
 	// optional (npm)
 	author?: string | Person;

diff --git a/src/package.ts b/src/package.ts
@@ -454,7 +454,7 @@ export class ManifestProcessor extends BaseProcessor {
 							.join(',')
 					: '',
 			preRelease: !!this.options.preRelease,
-			sponsorLink: manifest.sponsor || '',
+			sponsorLink: manifest.sponsor?.url || '',
 		};
 
 		if (isGitHub) {
@@ -605,7 +605,7 @@ export class TagsProcessor extends BaseProcessor {
 		);
 
 		const webExensionTags = isWebKind(this.manifest) ? ['__web_extension'] : [];
-		const sponsorTags = this.manifest.sponsor ? ['__sponsor_extension'] : [];
+		const sponsorTags = this.manifest.sponsor?.url ? ['__sponsor_extension'] : [];
 
 		const tags = new Set([
 			...keywords,
@@ -1221,6 +1221,21 @@ export function validateManifest(manifest: Manifest): Manifest {
 		}
 	}
 
+	if (manifest.sponsor) {
+		let isValidSponsorUrl = true;
+		try {
+			const sponsorUrl = new url.URL(manifest.sponsor.url);
+			isValidSponsorUrl = /^(https|http):$/i.test(sponsorUrl.protocol);
+		} catch (error) {
+			isValidSponsorUrl = false;
+		}
+		if (!isValidSponsorUrl) {
+			throw new Error(
+				`Manifest contains invalid value '${manifest.sponsor.url}' in the 'sponsor' property. It must be a valid URL with a HTTP or HTTPS protocol.`
+			);
+		}
+	}
+
 	return manifest;
 }
 

diff --git a/src/test/package.test.ts b/src/test/package.test.ts
@@ -383,6 +383,13 @@ describe('validateManifest', () => {
 		validateManifest(createManifest({ extensionKind: ['ui', 'workspace'] }));
 		validateManifest(createManifest({ extensionKind: ['workspace', 'ui'] }));
 	});
+
+	it('should validate sponsor', () => {
+		assert.throws(() => validateManifest(createManifest({ sponsor: { url: 'hello' } })));
+		assert.throws(() => validateManifest(createManifest({ sponsor: { url: 'www.foo.com' } })));
+		validateManifest(createManifest({ sponsor: { url: 'https://foo.bar' } }));
+		validateManifest(createManifest({ sponsor: { url: 'http://www.foo.com' } }));
+	});
 });
 
 describe('toVsixManifest', () => {
@@ -1661,7 +1668,7 @@ describe('toVsixManifest', () => {
 	});
 
 	it('should add sponsor link property', () => {
-		const sponsor = 'https://foo.bar';
+		const sponsor = { url: 'https://foo.bar' };
 		const manifest: Manifest = {
 			name: 'test',
 			publisher: 'mocha',
@@ -1676,12 +1683,12 @@ describe('toVsixManifest', () => {
 			.then(result => {
 				const properties = result.PackageManifest.Metadata[0].Properties[0].Property;
 				const sponsorLinkProp = properties.find(p => p.$.Id === 'Microsoft.VisualStudio.Code.SponsorLink');
-				assert.strictEqual(sponsorLinkProp?.$.Value, sponsor);
+				assert.strictEqual(sponsorLinkProp?.$.Value, sponsor.url);
 			});
 	});
 
 	it('should automatically add sponsor tag for extension with sponsor link', async () => {
-		const manifest = createManifest({ sponsor: 'https://foo.bar' });
+		const manifest = createManifest({ sponsor: { url: 'https://foo.bar' } });
 		const vsixManifest = await _toVsixManifest(manifest, []);
 		const result = await parseXmlManifest(vsixManifest);