Merge pull request #288 from easyops-cn/steve/fix-version

fix: refine version in search page
easyops-cn · Oct 18, 2022 · 01bd68d · 01bd68d
2 parents 5c934cd + 6d091b7
commit 01bd68d
Showing 1 changed file with 12 additions and 6 deletions.
diff --git a/docusaurus-search-local/src/client/theme/SearchBar/fetchIndexes.ts b/docusaurus-search-local/src/client/theme/SearchBar/fetchIndexes.ts
@@ -38,13 +38,19 @@ export async function legacyFetchIndexes(
   searchContext: string
 ): Promise<IndexesData> {
   if (process.env.NODE_ENV === "production") {
+    const url = `${baseUrl}${searchIndexUrl.replace(
+      "{dir}",
+      searchContext ? `-${searchContext.replace(/\//g, "-")}` : ""
+    )}`;
+
+    // Catch potential attacks.
+    const fullUrl = new URL(url, location.origin);
+    if (fullUrl.origin !== location.origin) {
+      throw new Error("Unexpected version url");
+    }
+
     const json = (await (
-      await fetch(
-        `${baseUrl}${searchIndexUrl.replace(
-          "{dir}",
-          searchContext ? `-${searchContext.replace(/\//g, "-")}` : ""
-        )}`
-      )
+      await fetch(url)
     ).json()) as SerializedIndex[];
 
     const wrappedIndexes: WrappedIndex[] = json.map(