From 157483cea9d450cadd29edecfd6a1fc2d77b2a18 Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Fri, 2 May 2025 15:28:42 +0200
Subject: [PATCH] Fix redirect issue

---
 www/bounce/main.js                | 21 ++++++++++++++++++++-
 www/common/common-interface.js    |  1 +
 www/common/sframe-common-outer.js |  6 ------
 www/common/sframe-common.js       |  4 ----
 4 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/www/bounce/main.js b/www/bounce/main.js
index ac4a10968..cf69f33c5 100644
--- a/www/bounce/main.js
+++ b/www/bounce/main.js
@@ -11,13 +11,32 @@ define(['/api/config'], function (ApiConfig) {
 
 */
 
+
     // when a URL is rejected we close the window
     var reject = function () {
         window.close();
     };
+
+    // only redirect if the request comes from CryptPad's sandbox
+    const safeOrigin = new URL(ApiConfig.httpSafeOrigin).origin;
+    if (!document.referrer) {
+        window.alert('This link only works when loaded from a CryptPad document');
+        return void reject();
+    }
+    try {
+        const parsed = new URL(document.referrer);
+        if (parsed.origin !== safeOrigin) {
+            window.alert('Invalid referrer');
+            return void reject();
+        }
+    } catch (e) {
+        console.error("Invalid referrer", e);
+        return;
+    }
+
     // this app is intended to be loaded and used exclusively from the sandbox domain
     // where stricter CSP blocks various attacks. Reject any other usage.
-    if (ApiConfig.httpSafeOrigin !== window.location.origin) {
+    if (safeOrigin !== window.location.origin) {
         window.alert('The bounce application must only be used from the sandbox domain, ' +
             'please report this issue on https://github.com/cryptpad/cryptpad');
         return void reject();
diff --git a/www/common/common-interface.js b/www/common/common-interface.js
index 92633fdf1..1f849c1bf 100644
--- a/www/common/common-interface.js
+++ b/www/common/common-interface.js
@@ -1126,6 +1126,7 @@ define([
                 window.open('/bounce/#'+encodeURIComponent(href));
                 return;
             }
+            // XXX
             window.parent.location = href;
         });
         if (exitable) {
diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index 3683aaa45..30e3ccda1 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -1038,12 +1038,6 @@ define([
                 });
                 sframeChan.on('EV_OPEN_URL', openURL);
 
-                sframeChan.on('EV_OPEN_UNSAFE_URL', function (url) {
-                    if (url) {
-                        window.open(ApiConfig.httpSafeOrigin + '/bounce/#' + encodeURIComponent(url));
-                    }
-                });
-
                 sframeChan.on('Q_GET_PAD_METADATA', function (data, cb) {
                     if (!data || !data.channel) {
                         data = {
diff --git a/www/common/sframe-common.js b/www/common/sframe-common.js
index 915a922fc..9d7ceb3e5 100644
--- a/www/common/sframe-common.js
+++ b/www/common/sframe-common.js
@@ -708,10 +708,6 @@ define([
         return window.location.origin + '/bounce/#' + encodeURIComponent(url);
     };
     funcs.openUnsafeURL = function (url) {
-        var app = ctx.metadataMgr.getPrivateData().app;
-        if (app === "sheet") {
-            return void ctx.sframeChan.event('EV_OPEN_UNSAFE_URL', url);
-        }
         var bounceHref = window.location.origin + '/bounce/#' + encodeURIComponent(url);
         window.open(bounceHref);
     };