fix: incomplete url substring sanitization

ZickZenni · Sep 18, 2024 · 273003e · 273003e
1 parent 836a056
commit 273003e
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/renderer/hooks/useGif.ts b/src/renderer/hooks/useGif.ts
@@ -1,11 +1,15 @@
 import { useEffect, useState } from 'react';
 import { TenorFetchResult, TenorGif } from '../../main/utils/tenor';
 
+const allowedHosts = ['tenor.com', 'www.tenor.com'];
+
 export default function useGif(url: string): TenorGif | null {
   const [gif, setGif] = useState<TenorGif | null>(null);
 
   useEffect(() => {
-    if (!url.startsWith('https://tenor.com')) {
+    const uri = new URL(url);
+
+    if (allowedHosts.includes(uri.host.toLowerCase())) {
       setGif(null);
       return;
     }