fix: handle IPv6 addresses properly in hostName and localhost

packages/utils/package.json

@@ -15,6 +15,7 @@
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch --no-clean",
+    "test": "vitest run",
     "check:lint": "oxlint --max-warnings=38 .",
     "check:types": "tsc --noEmit",
     "check:format": "oxfmt --check .",
@@ -53,6 +54,7 @@
     "@types/react": "catalog:",
     "@types/sanitize-html": "catalog:",
     "tsdown": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }

packages/utils/src/url.ts

@@ -8,7 +8,7 @@ import tlds from "./tlds";
 
 const PROTOCOL_REGEX = /^[a-zA-Z]+:\/\//;
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const LOCALHOST_ADDRESSES = ["localhost", "127.0.0.1", "0.0.0.0"];
+const LOCALHOST_ADDRESSES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "[::1]", "::", "[::]"]);
 const HTTP_PROTOCOL = "http://";
 const MAILTO_PROTOCOL = "mailto:";
 const DEFAULT_PROTOCOL = HTTP_PROTOCOL;
@@ -75,7 +75,7 @@ export function validateIPAddress(ip: string): {
  */
 export function isLocalhost(url: string): boolean {
   const hostname = extractHostname(url);
-  return LOCALHOST_ADDRESSES.includes(hostname);
+  return LOCALHOST_ADDRESSES.has(hostname);
 }
 
 /**
@@ -84,7 +84,9 @@ export function isLocalhost(url: string): boolean {
  * @returns The cleaned hostname
  */
 export function extractHostname(url: string): string {
-  let hostname = url;
+  if (!url || typeof url !== "string") return "";
+
+  let hostname = url.trim();
 
   // Remove protocol if present
   if (hostname.includes("://")) {
@@ -97,8 +99,20 @@ export function extractHostname(url: string): string {
     hostname = hostname.substring(atIndex + 1);
   }
 
-  // Remove path, query, hash, and port in one pass
-  hostname = hostname.split("/")[0].split("?")[0].split("#")[0].split(":")[0];
+  // Remove path, query, hash first
+  hostname = hostname.split("/")[0].split("?")[0].split("#")[0];
+
+  // Handle port removal:
+  // For bracketed IPv6 addresses (e.g. [::1]:3000 or [2001:db8::1]:8080)
+  if (hostname.startsWith("[")) {
+    const closingBracketIndex = hostname.indexOf("]");
+    if (closingBracketIndex !== -1) {
+      hostname = hostname.substring(0, closingBracketIndex + 1);
+    }
+  } else if (!hostname.includes(":") || (hostname.match(/:/g) || []).length === 1) {
+    // IPv4 or standard hostname with optional port (e.g. localhost:3000, 127.0.0.1:8000, example.com:80)
+    hostname = hostname.split(":")[0];
+  }
 
   return hostname;
 }

packages/utils/tests/url.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import { describe, expect, it } from "vitest";
+import {
+  extractHostname,
+  extractTLD,
+  extractURLComponents,
+  formatURLForDisplay,
+  isLocalhost,
+  isValidIPv4,
+  isValidIPv6,
+  isValidNextPath,
+  validateIPAddress,
+} from "../src/url";
+
+describe("extractHostname", () => {
+  it("should extract hostname from standard HTTP/HTTPS URLs", () => {
+    expect(extractHostname("https://plane.so")).toBe("plane.so");
+    expect(extractHostname("http://localhost:3000/dashboard")).toBe("localhost");
+    expect(extractHostname("https://app.plane.so/workspace/issues?tab=all#top")).toBe("app.plane.so");
+  });
+
+  it("should strip ports from IPv4 and domain names", () => {
+    expect(extractHostname("http://127.0.0.1:8000")).toBe("127.0.0.1");
+    expect(extractHostname("127.0.0.1:8000")).toBe("127.0.0.1");
+    expect(extractHostname("example.com:8080")).toBe("example.com");
+  });
+
+  it("should correctly handle IPv6 URLs without truncating to bracket", () => {
+    expect(extractHostname("http://[::1]:3000")).toBe("[::1]");
+    expect(extractHostname("https://[2001:db8::1]:8080/api/v1")).toBe("[2001:db8::1]");
+    expect(extractHostname("[::1]:3000")).toBe("[::1]");
+    expect(extractHostname("[::1]")).toBe("[::1]");
+    expect(extractHostname("::1")).toBe("::1");
+  });
+
+  it("should remove auth credentials if present", () => {
+    expect(extractHostname("https://user:password@example.com:8080/path")).toBe("example.com");
+  });
+
+  it("should handle empty or non-string inputs safely", () => {
+    expect(extractHostname("")).toBe("");
+    expect(extractHostname(null as any)).toBe("");
+    expect(extractHostname(undefined as any)).toBe("");
+  });
+});
+
+describe("isLocalhost", () => {
+  it("should return true for IPv4 localhost addresses", () => {
+    expect(isLocalhost("http://localhost:3000")).toBe(true);
+    expect(isLocalhost("http://127.0.0.1:8000")).toBe(true);
+    expect(isLocalhost("http://0.0.0.0:8000")).toBe(true);
+    expect(isLocalhost("localhost:3000")).toBe(true);
+    expect(isLocalhost("127.0.0.1")).toBe(true);
+  });
+
+  it("should return true for IPv6 localhost loopback addresses", () => {
+    expect(isLocalhost("http://[::1]:3000")).toBe(true);
+    expect(isLocalhost("https://[::1]:8080/api")).toBe(true);
+    expect(isLocalhost("[::1]:3000")).toBe(true);
+    expect(isLocalhost("[::1]")).toBe(true);
+    expect(isLocalhost("::1")).toBe(true);
+    expect(isLocalhost("[::]")).toBe(true);
+  });
+
+  it("should return false for public domains and non-localhost addresses", () => {
+    expect(isLocalhost("https://plane.so")).toBe(false);
+    expect(isLocalhost("https://google.com")).toBe(false);
+    expect(isLocalhost("http://[2001:db8::1]:8000")).toBe(false);
+    expect(isLocalhost("192.168.1.1")).toBe(false);
+  });
+});
+
+describe("formatURLForDisplay", () => {
+  it("should format valid URLs for display", () => {
+    expect(formatURLForDisplay("https://plane.so/features")).toBe("plane.so");
+    expect(formatURLForDisplay("http://localhost:3000/dashboard")).toBe("localhost:3000");
+  });
+
+  it("should format IPv6 URLs without returning single bracket", () => {
+    expect(formatURLForDisplay("http://[::1]:3000")).toBe("[::1]:3000");
+    expect(formatURLForDisplay("[::1]:3000")).toBe("[::1]");
+  });
+
+  it("should return empty string for empty input", () => {
+    expect(formatURLForDisplay("")).toBe("");
+  });
+});
+
+describe("extractTLD", () => {
+  it("should extract valid TLD from URL strings", () => {
+    expect(extractTLD("https://plane.so")).toBe("so");
+    expect(extractTLD("https://example.com/path")).toBe("com");
+    expect(extractTLD("sub.domain.co.uk")).toBe("uk");
+  });
+
+  it("should return empty string for invalid domains or IP addresses", () => {
+    expect(extractTLD("")).toBe("");
+    expect(extractTLD(".invalid.")).toBe("");
+    expect(extractTLD("http://localhost:3000")).toBe("");
+    expect(extractTLD("http://127.0.0.1")).toBe("");
+  });
+});
+
+describe("validateIPAddress & isValidIPv4 & isValidIPv6", () => {
+  it("should validate IPv4 addresses", () => {
+    expect(isValidIPv4("127.0.0.1")).toBe(true);
+    expect(isValidIPv4("192.168.1.1")).toBe(true);
+    expect(isValidIPv4("256.0.0.1")).toBe(false);
+    expect(isValidIPv4("invalid")).toBe(false);
+  });
+
+  it("should validate IPv6 addresses", () => {
+    expect(isValidIPv6("::1")).toBe(true);
+    expect(isValidIPv6("[::1]")).toBe(true);
+    expect(isValidIPv6("2001:db8::1")).toBe(true);
+    expect(isValidIPv6("invalid")).toBe(false);
+  });
+
+  it("should return correct type from validateIPAddress", () => {
+    expect(validateIPAddress("127.0.0.1")).toEqual({ isValid: true, type: "ipv4", formatted: "127.0.0.1" });
+    expect(validateIPAddress("[::1]")).toEqual({ isValid: true, type: "ipv6", formatted: "::1" });
+    expect(validateIPAddress("invalid")).toEqual({ isValid: false, type: "invalid" });
+  });
+});
+
+describe("extractURLComponents", () => {
+  it("should parse full URLs correctly", () => {
+    const components = extractURLComponents("https://blog.plane.so/posts");
+    expect(components).toBeDefined();
+    expect(components?.protocol).toBe("https");
+    expect(components?.subdomain).toBe("blog");
+    expect(components?.rootDomain).toBe("plane");
+    expect(components?.tld).toBe("so");
+    expect(components?.pathname).toBe("/posts");
+  });
+
+  it("should parse IPv6 localhost URLs correctly", () => {
+    const components = extractURLComponents("http://[::1]:3000/dashboard");
+    expect(components).toBeDefined();
+    expect(components?.protocol).toBe("http");
+    expect(components?.pathname).toBe("/dashboard");
+  });
+});
+
+describe("isValidNextPath", () => {
+  it("should allow safe relative redirect paths", () => {
+    expect(isValidNextPath("/dashboard")).toBe(true);
+    expect(isValidNextPath("/workspace/123/projects")).toBe(true);
+    expect(isValidNextPath("  /profile  ")).toBe(true);
+  });
+
+  it("should reject open redirect and malicious paths", () => {
+    expect(isValidNextPath("https://malicious.com")).toBe(false);
+    expect(isValidNextPath("//malicious.com")).toBe(false);
+    expect(isValidNextPath("javascript:alert(1)")).toBe(false);
+    expect(isValidNextPath("\\malicious")).toBe(false);
+    expect(isValidNextPath("dashboard")).toBe(false);
+    expect(isValidNextPath("")).toBe(false);
+  });
+});