Merge pull request #201 from ndmedeiros/feature/vuln

[CHANGED] solve a vulnerability bug
mercadolibre · Apr 11, 2024 · db5dff0 · db5dff0
2 parents 4eb3579 + 62044ae
commit db5dff0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,7 @@
+## [Unrelease] 
+### Changed
+- Se verifica una URL sacando la vulnerabilidade de injeción de HTML
+
 ## [1.56.2] - 2023-07-10
 ### Fixed
 - Se revierten cambios de LoyaltyCongrats para agilizar otros desarrollos

diff --git a/Source/Components/Touchpoints/LiveImages/MLBusinessLiveImagesWebView.swift b/Source/Components/Touchpoints/LiveImages/MLBusinessLiveImagesWebView.swift
@@ -50,6 +50,10 @@ class MLBusinessLiveImagesWebView: UIView {
     }
 
     func loadImage(from url: String) {
+        guard let urlString = URL(string: url) else {
+            return
+        }
+
         let html = """
         <html>
         <style>
@@ -91,7 +95,7 @@ class MLBusinessLiveImagesWebView: UIView {
         </html>
         """
 
-        let imageDataString = "data:image/webp;base64, \(url)"
+        let imageDataString = "data:image/webp;base64, \(urlString)"
 
         let s = html.replacingOccurrences(of: "[URL]", with: imageDataString)
         webview.loadHTMLString(s, baseURL: nil)
@@ -109,4 +113,3 @@ extension MLBusinessLiveImagesWebView: WKNavigationDelegate {
         imageAnimationManager?.changeState(to: .readyToPlay)
     }
 }
-