@@ -48,6 +48,16 @@ function getButtonClasses(buttonVariant: ButtonVariant): string {
4848 return `${ base } bg-primary hover:bg-primary/90 text-black font-black py-4 transition-all active:scale-[0.98] shadow-lg shadow-primary/20` ;
4949}
5050
51+ // Helper function to validate URLs and prevent XSS through 'javascript:' protocol
52+ function validateUrl ( url ?: string ) : string | undefined {
53+ if ( ! url ) return undefined ;
54+ const lowerUrl = url . toLowerCase ( ) ;
55+ if ( lowerUrl . startsWith ( "http://" ) || lowerUrl . startsWith ( "https://" ) ) {
56+ return url ;
57+ }
58+ return undefined ;
59+ }
60+
5161// Main component function that renders the support us button, taking in various props for customization and rendering different sections such as hero, organization information, sponsors, and call-to-action based on the provided data and selected theme and button variant
5262function SupportUsButton ( {
5363 Theme = "AOSSIE" ,
@@ -70,6 +80,7 @@ function SupportUsButton({
7080 } ,
7181 buttonVariant = "AOSSIE" ,
7282} : supportUsButtonProps ) : React . JSX . Element {
83+ const validatedUrl = validateUrl ( organizationInformation ?. url ) ;
7384 return (
7485 // Container for the support us button, with dynamic classes based on the selected theme and custom class names
7586 < div
@@ -161,27 +172,49 @@ function SupportUsButton({
161172 ) }
162173
163174 { /* Organization logo */ }
164- < div >
175+
176+ < div >
177+ { validatedUrl ? (
178+ < a
179+ href = { validatedUrl }
180+ target = "_blank"
181+ rel = "noopener noreferrer"
182+ title = { `Visit ${ organizationInformation ?. name } ` }
183+ >
165184 { typeof organizationInformation . logo === "string" ? (
166- < span
167- className = "block h-fit w-fit p-4 bg-black text-white rounded-2xl"
168- title = { organizationInformation . logo }
169- >
185+ < span className = "block h-fit w-fit p-4 bg-black text-white rounded-2xl" >
170186 < b className = "text-2xl italic" >
171187 { organizationInformation . logo }
172188 </ b >
173189 </ span >
174190 ) : (
175191 < img
176- className = "w-24 h-24 bg-white/80 pointer-none:cursor-none select-none rounded-2xl object-cover object-center"
192+ className = "w-24 h-24 bg-white/80 select-none rounded-2xl object-cover object-center"
177193 src = { organizationInformation . logo ?. src }
178194 alt = { organizationInformation . logo ?. alt }
179- title = { organizationInformation . logo ?. alt }
180195 draggable = { false }
181196 />
182197 ) }
183- </ div >
184-
198+ </ a >
199+ ) : (
200+ < >
201+ { typeof organizationInformation . logo === "string" ? (
202+ < span className = "block h-fit w-fit p-4 bg-black text-white rounded-2xl" >
203+ < b className = "text-2xl italic" >
204+ { organizationInformation . logo }
205+ </ b >
206+ </ span >
207+ ) : (
208+ < img
209+ className = "w-24 h-24 bg-white/80 select-none rounded-2xl object-cover object-center"
210+ src = { organizationInformation . logo ?. src }
211+ alt = { organizationInformation . logo ?. alt }
212+ draggable = { false }
213+ />
214+ ) }
215+ </ >
216+ ) }
217+ </ div >
185218 { /* Organization name and description */ }
186219 < div className = "flex flex-col gap-4" >
187220 < h2 className = { `font-extrabold text-4xl md:text-5xl lg:text-6xl` } >
@@ -192,6 +225,9 @@ function SupportUsButton({
192225 </ p >
193226 </ div >
194227
228+
229+
230+
195231 { /* Line */ }
196232 { organizationInformation . projectInformation && (
197233 < div
@@ -290,7 +326,7 @@ function SupportUsButton({
290326 < div className = "flex flex-row flex-wrap justify-center items-center gap-10 z-10" >
291327 { sponsors . map ( ( sponsor , index ) => (
292328 < a
293- href = { sponsor . link }
329+ href = { validateUrl ( sponsor . link ) }
294330 key = { index }
295331 target = "_blank"
296332 rel = "noopener noreferrer"
@@ -433,7 +469,7 @@ function SupportUsButton({
433469 < div className = "flex flex-wrap justify-center items-center gap-5 mt-8" >
434470 { ctaSection . sponsorLink . map ( ( link , index ) => (
435471 < a
436- href = { link . url }
472+ href = { validateUrl ( link . url ) }
437473 key = { index }
438474 { ...( link . newTab && { target : "_blank" } ) }
439475 rel = "noopener noreferrer"
@@ -454,4 +490,4 @@ function SupportUsButton({
454490 ) ;
455491}
456492
457- export default SupportUsButton ;
493+ export default SupportUsButton ;
0 commit comments