diff --git a/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex b/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex index bcb1734091f0..ecf98e0c96f6 100644 --- a/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex +++ b/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex @@ -41,7 +41,7 @@
<%= if external_url(@token_instance.instance) do %> - target="_blank"> + target="_blank"> View In App <%= render BlockScoutWeb.IconsView, "_external_link.html" %> diff --git a/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex b/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex index 1c0c748dc415..ba62117bd6a3 100644 --- a/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex +++ b/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex @@ -102,10 +102,14 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewView do def external_url(nil), do: nil + def external_url("http" <> _rest = external_url), do: external_url + + def external_url(string) when is_binary(string), do: external_url(nil) + def external_url(instance) do result = if instance.metadata && instance.metadata["external_url"] do - instance.metadata["external_url"] + instance.metadata["external_url"] |> external_url() else external_url(nil) end diff --git a/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs b/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs index a1783b9cc957..37d0417cf88c 100644 --- a/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs +++ b/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs @@ -127,7 +127,7 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewViewTest do "name": "CELO XSS", "image": "https://0-a.nl/nft/nft.jpg", "description": "CELO XSS", - "external_url": "javascript:eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYW'))" + "external_url": "javascript:eval(atob('YWxlcnQoIndoYXRzdXAgaXQncyB5YSBib3l5Iik'))" } """ @@ -135,7 +135,24 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewViewTest do result = OverviewView.external_url(%{metadata: data}) - refute String.starts_with?(result, "javascript"), "non http url schemes should be stripped from external_url" + assert result == nil, "non http url schemes should be stripped from external_url and treated as missing" + end + + test "Returns valid uri scheme" do + json = """ + { + "name": "CELO NFT test", + "image": "https://0-a.nl/nft/nft.jpg", + "description": "CELO NFT test", + "external_url": "https://happyland.nft" + } + """ + + data = Jason.decode!(json) + + result = OverviewView.external_url(%{metadata: data}) + + assert String.starts_with?(result, "http"), "Valid url should be returned" end end end