Merge commit from fork

* fix: only open http and https editor urls

Validate the editor url protocol before opening it, so only absolute http and https urls
are used.

* fix: address review feedback

- drop the redundant guard in post.ts; the editor action in embed.ts already gates the url
- return early rather than nesting the editor-link code
- condense the isValidEditorURL docstring

* fix: rework editor action guard and condense docstring

- return early rather than nesting the editor-link code in embed.ts
- condense the isValidEditorURL docstring

These were staged but missing from 620b96f; committing them now.

Author: earaghbidikashani

src/embed.ts

@@ -29,7 +29,7 @@ import {Handler, Options as TooltipOptions} from 'vega-tooltip';
 import post from './post.js';
 import embedStyle from './style.js';
 import {Config, ExpressionFunction, Mode} from './types.js';
-import {mergeDeep} from './util.js';
+import {isValidEditorURL, mergeDeep} from './util.js';
 import pkg from '../package.json';
 
 export const version = pkg.version;
@@ -517,8 +517,12 @@ async function _embed(
     }
 
     // add 'Open in Vega Editor' action
-    if (actions === true || actions.editor !== false) {
-      const editorUrl = opts.editorUrl ?? 'https://vega.github.io/editor/';
+    const editorUrl = opts.editorUrl ?? 'https://vega.github.io/editor/';
+    const showEditorAction = actions === true || actions.editor !== false;
+
+    if (showEditorAction && !isValidEditorURL(editorUrl)) {
+      logger.warn(`Ignoring the editor action since editorUrl is not an http or https url: ${editorUrl}`);
+    } else if (showEditorAction) {
       const editorLink = document.createElement('a');
 
       editorLink.text = i18n.EDITOR_ACTION;

src/util.ts

@@ -4,6 +4,21 @@ export function isURL(s: string): boolean {
   return s.startsWith('http://') || s.startsWith('https://') || s.startsWith('//');
 }
 
+/**
+ * Return true if the string is a valid URL using a supported protocol (absolute paths using HTTP or HTTPS only).
+ */
+export function isValidEditorURL(url: string): boolean {
+  let protocol: string;
+
+  try {
+    ({protocol} = new URL(url));
+  } catch {
+    return false;
+  }
+
+  return protocol === 'http:' || protocol === 'https:';
+}
+
 export type DeepPartial<T> = {[P in keyof T]?: P extends unknown ? unknown : DeepPartial<T[P]>};
 
 export function mergeDeep<T>(dest: T, ...src: readonly DeepPartial<T>[]): T {