From 3c9c6eef6ea1595f73253c137018d6224dca7076 Mon Sep 17 00:00:00 2001
From: "Paul Gauthier (aider)" <aider@paulg.org>
Date: Mon, 18 Nov 2024 13:37:02 -0800
Subject: [PATCH] feat: Add URL validation and Content Security Policy to share
 page

---
 aider/website/share/index.md | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/aider/website/share/index.md b/aider/website/share/index.md
index f4a5d7248..95e755f26 100644
--- a/aider/website/share/index.md
+++ b/aider/website/share/index.md
@@ -2,6 +2,12 @@
 nav_exclude: true
 ---
 
+<meta http-equiv="Content-Security-Policy" 
+    content="default-src 'self'; 
+             script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; 
+             connect-src http: https:;
+             style-src 'self' 'unsafe-inline';">
+
 # Shared aider chat transcript
 
 A user has shared the following transcript of a pair programming chat session
@@ -38,10 +44,20 @@ print("goodbye")
 
 <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
 <script>
+function isValidUrl(url) {
+    try {
+        const urlObj = new URL(url);
+        return urlObj.protocol === 'http:' || urlObj.protocol === 'https:';
+    } catch {
+        return false;
+    }
+}
+
 window.onload = function() {
     var urlParams = new URLSearchParams(window.location.search);
     var conv = urlParams.get('mdurl');
-    if (!conv) {
+    if (!conv || !isValidUrl(conv)) {
+        console.error('Invalid or missing URL');
         return;
     }
     document.getElementById('mdurl').href = conv;