diff --git a/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex b/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex
index bcb1734091f0..ecf98e0c96f6 100644
--- a/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex
+++ b/apps/block_scout_web/lib/block_scout_web/templates/tokens/instance/overview/_details.html.eex
@@ -41,7 +41,7 @@
<%= if external_url(@token_instance.instance) do %>
- target="_blank">
+ target="_blank">
View In App <%= render BlockScoutWeb.IconsView, "_external_link.html" %>
diff --git a/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex b/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex
index 1c0c748dc415..ba62117bd6a3 100644
--- a/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex
+++ b/apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex
@@ -102,10 +102,14 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewView do
def external_url(nil), do: nil
+ def external_url("http" <> _rest = external_url), do: external_url
+
+ def external_url(string) when is_binary(string), do: external_url(nil)
+
def external_url(instance) do
result =
if instance.metadata && instance.metadata["external_url"] do
- instance.metadata["external_url"]
+ instance.metadata["external_url"] |> external_url()
else
external_url(nil)
end
diff --git a/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs b/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs
index a1783b9cc957..37d0417cf88c 100644
--- a/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs
+++ b/apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs
@@ -127,7 +127,7 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewViewTest do
"name": "CELO XSS",
"image": "https://0-a.nl/nft/nft.jpg",
"description": "CELO XSS",
- "external_url": "javascript:eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYW'))"
+ "external_url": "javascript:eval(atob('YWxlcnQoIndoYXRzdXAgaXQncyB5YSBib3l5Iik'))"
}
"""
@@ -135,7 +135,24 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewViewTest do
result = OverviewView.external_url(%{metadata: data})
- refute String.starts_with?(result, "javascript"), "non http url schemes should be stripped from external_url"
+ assert result == nil, "non http url schemes should be stripped from external_url and treated as missing"
+ end
+
+ test "Returns valid uri scheme" do
+ json = """
+ {
+ "name": "CELO NFT test",
+ "image": "https://0-a.nl/nft/nft.jpg",
+ "description": "CELO NFT test",
+ "external_url": "https://happyland.nft"
+ }
+ """
+
+ data = Jason.decode!(json)
+
+ result = OverviewView.external_url(%{metadata: data})
+
+ assert String.starts_with?(result, "http"), "Valid url should be returned"
end
end
end