Skip to content

Improve URL validator to support localhost and local IPs in development #1122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 10 commits into
base: enext
Choose a base branch
from
Draft

Improve URL validator to support localhost and local IPs in development #1122

Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
64669b8
Improve URL validator to support localhost and local IPs in development
suhailnadaf509 Oct 27, 2025
6d31cf5
remove dependency from env-dev
suhailnadaf509 Oct 27, 2025
3a7d106
Merge branch 'enext' into Url-validator-fix
mariobehling Oct 27, 2025
7ac4963
Update app/eventyay/webapp/src/lib/validators.js
suhailnadaf509 Oct 27, 2025
a299055
Merge branch 'enext' into Url-validator-fix
mariobehling Oct 29, 2025
9caa1fe
added debug to ensure development mode instead of webapp env variable
suhailnadaf509 Nov 1, 2025
a976e8f
resolvemerge conflicts
suhailnadaf509 Nov 1, 2025
0f7b52c
Merge branch 'enext' into Url-validator-fix
suhailnadaf509 Nov 1, 2025
c7fa749
Merge branch 'enext' into Url-validator-fix
mariobehling Nov 7, 2025
03c756b
Merge branch 'enext' into Url-validator-fix
mariobehling Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions app/eventyay/webapp/src/lib/validators.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,10 @@ export function youtubeid(message) {
return helpers.withMessage(message, helpers.regex(/^[0-9A-Za-z_-]{5,}$/))
}
const relative = helpers.regex(/^\/.*$/)
const devurl = helpers.regex(/^http:\/\/localhost.*$/) // vuelidate does not allow localhost
// Allow localhost and local IP addresses (with or without port)
const localurl = helpers.regex(/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:[0-9]+)?(\/.*)?$/)
export function url(message) {
return helpers.withMessage(message, (value) => (!helpers.req(value) || _url(value) || relative(value) || (ENV_DEVELOPMENT && devurl(value))))
return helpers.withMessage(message, (value) => (!helpers.req(value) || _url(value) || relative(value) || localurl(value)))
Copy link

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing the ENV_DEVELOPMENT check allows local URLs in production environments, which could expose internal development endpoints or testing URLs. Consider keeping the environment check or adding explicit configuration to control when local URLs are acceptable.

Suggested change
return helpers.withMessage(message, (value) => (!helpers.req(value) || _url(value) || relative(value) || localurl(value)))
return helpers.withMessage(message, (value) => (
!helpers.req(value) ||
_url(value) ||
relative(value) ||
(typeof ENV_DEVELOPMENT !== 'undefined' && ENV_DEVELOPMENT === true && localurl(value))
))

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@suhailnadaf509 suhailnadaf509 Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ENV_DEVELOPMENT check expects the webapp to run in dev mode with a hot-reload server, but npm start under the webapp doesn’t work in our setup. So it was blocking valid localhost use.
Also here I am considering that we need localhost support in production for self-hosted and Docker setups.

}
export function isJson() {
return helpers.withMessage(({ $response }) => $response?.message, value => {
Expand Down