From ba617e4c771b7b6fa1594b0d89aa46e862d07964 Mon Sep 17 00:00:00 2001
From: Valentin Lorentz <vlorentz@softwareheritage.org>
Date: Fri, 25 Oct 2024 19:15:05 +0200
Subject: [PATCH] Make isUrl stricter

---
 cypress/integration/validation.js | 13 +++++++++++++
 js/utils.js                       |  4 ++++
 2 files changed, 17 insertions(+)

diff --git a/cypress/integration/validation.js b/cypress/integration/validation.js
index 2161406..5f1442c 100644
--- a/cypress/integration/validation.js
+++ b/cypress/integration/validation.js
@@ -160,6 +160,19 @@ describe('URLs validation', function() {
         cy.get('#errorMessage').should('have.text', 'Invalid URL in field "codeRepository": "foo"');
     });
 
+    it('errors on invalid URL that Javascript considers to be valid', function() {
+        cy.get('#codemetaText').then((elem) =>
+            elem.text(JSON.stringify({
+                "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
+                "@type": "SoftwareSourceCode",
+                "codeRepository": "foo: bar",
+            }))
+        );
+        cy.get('#validateCodemeta').click();
+
+        cy.get('#errorMessage').should('have.text', 'Invalid URL in field "codeRepository": "foo: bar"');
+    });
+
     it('errors on non-string instead of URL', function() {
         cy.get('#codemetaText').then((elem) =>
             elem.text(JSON.stringify({
diff --git a/js/utils.js b/js/utils.js
index 8285055..a18e13d 100644
--- a/js/utils.js
+++ b/js/utils.js
@@ -29,6 +29,10 @@ function trimSpaces(s) {
 function isUrl(s) {
     try {
         const url = new URL(s);
+        if (url.origin == "null") {
+            // forbids "foo: bar" as a URL, for example
+            return false;
+        }
         return true;
     } catch (e) {
         return false;