Merge pull request #1927 from matrix-org/rxl881/ImURLCheck

More thorough check of IM URL validity.

src/components/views/elements/AppTile.js

@@ -122,25 +122,34 @@ export default class AppTile extends React.Component {
 
     /**
      * Returns true if specified url is a scalar URL, typically https://scalar.vector.im/api
-     * @param  {[type]}  url URL to check
+     * @param  {[type]}  testUrlString URL to check
      * @return {Boolean} True if specified URL is a scalar URL
      */
-    isScalarUrl(url) {
+    isScalarUrl(testUrlString) {
-        if (!url) {
+        if (!testUrlString) {
             console.error('Scalar URL check failed. No URL specified');
             return false;
         }
 
+        const testUrl = url.parse(testUrlString);
+
         let scalarUrls = SdkConfig.get().integrations_widgets_urls;
         if (!scalarUrls || scalarUrls.length == 0) {
             scalarUrls = [SdkConfig.get().integrations_rest_url];
         }
 
         for (let i = 0; i < scalarUrls.length; i++) {
-            if (url.startsWith(scalarUrls[i])) {
+            const scalarUrl = url.parse(scalarUrls[i]);
+            if (testUrl && scalarUrl) {
+                if (
+                    testUrl.protocol === scalarUrl.protocol &&
+                    testUrl.host === scalarUrl.host &&
+                    testUrl.pathname.startsWith(scalarUrl.pathname)
+                ) {
                     return true;
                 }
             }
+        }
         return false;
     }
 
@@ -269,7 +278,12 @@ export default class AppTile extends React.Component {
             event.origin = event.originalEvent.origin;
         }
 
-        if (!this.state.widgetUrl.startsWith(event.origin)) {
+        const widgetUrlObj = url.parse(this.state.widgetUrl);
+        const eventOrigin = url.parse(event.origin);
+        if (
+            eventOrigin.protocol !== widgetUrlObj.protocol ||
+            eventOrigin.host !== widgetUrlObj.host
+        ) {
             return;
         }