Function validateThemeRoot

packages/base/src/validateThemeRoot.ts:29–68

(themeRoot: string)

};

const validateThemeRoot = (themeRoot: string) => {
	let resultUrl;
	let isSameOrigin = false;

	try {
		if (themeRoot.startsWith(".") || (themeRoot.startsWith("/") && !themeRoot.startsWith("//"))) {
			// Handle relative url
			// new URL("/newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
			// new URL("./newExmPath", "http://example.com/exmPath") => http://example.com/exmPath/newExmPath
			// new URL("../newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
			resultUrl = new URL(themeRoot, getLocationHref()).toString();
			isSameOrigin = true;
		} else {
			// Protocol-relative URLs (//host/path) need a base to resolve the protocol
			const themeRootURL = themeRoot.startsWith("//") ? new URL(themeRoot, getLocationHref()) : new URL(themeRoot);
			const origin = themeRootURL.origin;
			const currentOrigin = new URL(getLocationHref()).origin;

			// Check if the absolute URL is same-origin
			isSameOrigin = origin === currentOrigin;

			if (origin && validateThemeOrigin(origin, isSameOrigin)) {
				// If origin is allowed, use it
				resultUrl = themeRootURL.toString();
			} else {
				// If origin is not allowed, return undefined to indicate validation failed
				return undefined;
			}
		}

		if (!resultUrl.endsWith("/")) {
			resultUrl = `${resultUrl}/`;
		}

		return `${resultUrl}UI5/`;
	} catch (e) {
		// Catch if URL is not correct
		return undefined;
	}
};

export default validateThemeRoot;