fix: Reject repository URLs with embedded credentials [VER-533]

server/src/__tests__/projects.test.ts

@@ -45,7 +45,11 @@ describe('Projects API', () => {
   });
 
   it('rejects an invalid repository URL without persisting a project', async () => {
-    for (const repoUrl of ['not-a-url', 'javascript:alert(document.domain)']) {
+    for (const repoUrl of [
+      'not-a-url',
+      'javascript:alert(document.domain)',
+      'https://token@github.com/org/repo',
+    ]) {
       await request(app)
         .post(`/api/companies/${companyId}/projects`)
         .send({ name: 'Invalid repository', repoUrl })

server/src/routes/projects.ts

@@ -7,14 +7,17 @@ import eventBus from '../realtime/events.js';
 import type { DbInstance } from '../types.js';
 import { routeParams } from '../utils/route-params.js';
 
+// Userinfo is rejected alongside non-http(s) schemes: a credential-bearing URL such as
+// https://token@host/org/repo would be persisted and rendered verbatim, leaking the secret.
 const HttpUrl = z.string().url().refine((value) => {
   try {
-    const protocol = new URL(value).protocol;
-    return protocol === 'http:' || protocol === 'https:';
+    const url = new URL(value);
+    const isHttpProtocol = url.protocol === 'http:' || url.protocol === 'https:';
+    return isHttpProtocol && url.username === '' && url.password === '';
   } catch {
     return false;
   }
-}, 'Repository URL must start with http:// or https://');
+}, 'Repository URL must start with http:// or https:// and must not embed credentials');
 
 const CreateProjectBody = z.object({
   name: z.string().min(1).max(255),

ui/src/components/projects/ProjectFormModal.tsx

@@ -29,7 +29,10 @@ const projectSchema = z.object({
     z.literal(""),
     z
       .url("Enter a complete repository URL, such as https://github.com/org/repo.")
-      .refine(isHttpUrl, "Repository URL must start with http:// or https://."),
+      .refine(
+        isHttpUrl,
+        "Use an http(s) repository URL without embedded credentials, such as https://github.com/org/repo.",
+      ),
   ]),
 });
 

ui/src/lib/urls.ts

@@ -1,7 +1,13 @@
+/**
+ * True when the value is an absolute http(s) URL with no embedded credentials.
+ * Userinfo is rejected because a repository URL such as https://token@host/org/repo
+ * would otherwise be persisted and rendered verbatim, leaking the secret.
+ */
 export function isHttpUrl(value: string): boolean {
   try {
-    const protocol = new URL(value).protocol;
-    return protocol === "http:" || protocol === "https:";
+    const url = new URL(value);
+    const isHttpProtocol = url.protocol === "http:" || url.protocol === "https:";
+    return isHttpProtocol && url.username === "" && url.password === "";
   } catch {
     return false;
   }

ui/test/CreateProjectModal.test.tsx

@@ -73,7 +73,10 @@ describe("CreateProjectModal", () => {
     expect(mocks.createProject).not.toHaveBeenCalled();
   });
 
-  it("rejects repository URLs with executable schemes", async () => {
+  it.each([
+    ["executable schemes", "javascript:alert(document.domain)"],
+    ["embedded credentials", "https://token@github.com/org/repo"],
+  ])("rejects repository URLs with %s", async (_label, value) => {
     const user = userEvent.setup();
     render(
       <CreateProjectModal
@@ -85,14 +88,11 @@ describe("CreateProjectModal", () => {
     );
 
     await user.type(screen.getByLabelText("Project name"), "Runtime reliability");
-    await user.type(
-      screen.getByLabelText("Repository URL"),
-      "javascript:alert(document.domain)",
-    );
+    await user.type(screen.getByLabelText("Repository URL"), value);
     await user.click(screen.getByRole("button", { name: "Create Project" }));
 
     expect(screen.getByRole("alert")).toHaveTextContent(
-      "Repository URL must start with http:// or https://.",
+      "Use an http(s) repository URL without embedded credentials, such as https://github.com/org/repo.",
     );
     expect(mocks.createProject).not.toHaveBeenCalled();
   });