From 1c97e549eb4c154c3dbc7157d9917ef22fd7d350 Mon Sep 17 00:00:00 2001
From: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
Date: Tue, 14 Feb 2023 13:19:45 +0000
Subject: [PATCH] Implement URL validation on default videos links (#7087)

---
 .../components/eventtype/EventSetupTab.tsx    | 10 +++++++---
 apps/web/pages/apps/installed/[category].tsx  |  3 +++
 .../settings/my-account/conferencing.tsx      |  3 +++
 packages/app-store/locations.ts               |  2 +-
 .../components/AppSetDefaultLinkDialog.tsx    | 15 ++++++++++++--
 packages/trpc/server/routers/viewer.tsx       | 20 +++++++++++++++++++
 6 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/apps/web/components/eventtype/EventSetupTab.tsx b/apps/web/components/eventtype/EventSetupTab.tsx
index 83667c4ffe..5383f8f8da 100644
--- a/apps/web/components/eventtype/EventSetupTab.tsx
+++ b/apps/web/components/eventtype/EventSetupTab.tsx
@@ -196,6 +196,12 @@ export const EventSetupTab = (
               if (!eventLocationType) {
                 return null;
               }
+              // We dont want to translate the string link - it doesnt exist in common.json and it gets prefixed/suffixed with __ or //
+              const eventLabel =
+                eventLocationType.defaultValueVariable === "link"
+                  ? location[eventLocationType.defaultValueVariable]
+                  : t(location[eventLocationType.defaultValueVariable] || eventLocationType.label);
+
               return (
                 <li
                   key={`${location.type}${index}`}
@@ -207,9 +213,7 @@ export const EventSetupTab = (
                         className="h-4 w-4"
                         alt={`${eventLocationType.label} logo`}
                       />
-                      <span className="truncate text-sm ltr:ml-1 rtl:mr-1">
-                        {t(location[eventLocationType.defaultValueVariable] || eventLocationType.label)}
-                      </span>
+                      <span className="truncate text-sm ltr:ml-1 rtl:mr-1">{eventLabel}</span>
                     </div>
                     <div className="flex">
                       <button
diff --git a/apps/web/pages/apps/installed/[category].tsx b/apps/web/pages/apps/installed/[category].tsx
index b52b00777d..94fbc01f10 100644
--- a/apps/web/pages/apps/installed/[category].tsx
+++ b/apps/web/pages/apps/installed/[category].tsx
@@ -121,6 +121,9 @@ const IntegrationsList = ({ data, handleDisconnect, variant }: IntegrationsListP
       showToast("Default app updated successfully", "success");
       utils.viewer.getUsersDefaultConferencingApp.invalidate();
     },
+    onError: (error) => {
+      showToast(`Error: ${error.message}`, "error");
+    },
   });
 
   const { t } = useLocale();
diff --git a/apps/web/pages/settings/my-account/conferencing.tsx b/apps/web/pages/settings/my-account/conferencing.tsx
index 9552bfdabb..cc73c98ec4 100644
--- a/apps/web/pages/settings/my-account/conferencing.tsx
+++ b/apps/web/pages/settings/my-account/conferencing.tsx
@@ -66,6 +66,9 @@ const ConferencingLayout = () => {
       showToast("Default app updated successfully", "success");
       utils.viewer.getUsersDefaultConferencingApp.invalidate();
     },
+    onError: (error) => {
+      showToast(`Error: ${error.message}`, "error");
+    },
   });
 
   const [deleteAppModal, setDeleteAppModal] = useState(false);
diff --git a/packages/app-store/locations.ts b/packages/app-store/locations.ts
index daecdc69f3..02207656aa 100644
--- a/packages/app-store/locations.ts
+++ b/packages/app-store/locations.ts
@@ -15,7 +15,7 @@ export type DefaultEventLocationType = {
   category: string;
 
   iconUrl: string;
-
+  urlRegExp?: string;
   // HACK: `variable` and `defaultValueVariable` are required due to legacy reason where different locations were stored in different places.
   variable: "locationType" | "locationAddress" | "address" | "locationLink" | "locationPhoneNumber" | "phone";
   defaultValueVariable: "address" | "attendeeAddress" | "link" | "hostPhoneNumber" | "phone";
diff --git a/packages/features/apps/components/AppSetDefaultLinkDialog.tsx b/packages/features/apps/components/AppSetDefaultLinkDialog.tsx
index c514da3b8c..4179cb5997 100644
--- a/packages/features/apps/components/AppSetDefaultLinkDialog.tsx
+++ b/packages/features/apps/components/AppSetDefaultLinkDialog.tsx
@@ -1,7 +1,9 @@
+import { zodResolver } from "@hookform/resolvers/zod";
 import { Dispatch, SetStateAction } from "react";
 import { useForm } from "react-hook-form";
+import { z } from "zod";
 
-import { EventLocationType } from "@calcom/app-store/locations";
+import { EventLocationType, getEventLocationType } from "@calcom/app-store/locations";
 import { useLocale } from "@calcom/lib/hooks/useLocale";
 import { trpc } from "@calcom/trpc/react";
 import {
@@ -31,13 +33,22 @@ export function AppSetDefaultLinkDailog({
   const utils = trpc.useContext();
 
   const { t } = useLocale();
-  const form = useForm<LocationTypeSetLinkDialogFormProps>({});
+  const eventLocationTypeOptions = getEventLocationType(locationType.type);
+
+  const form = useForm<LocationTypeSetLinkDialogFormProps>({
+    resolver: zodResolver(
+      z.object({ link: z.string().regex(new RegExp(eventLocationTypeOptions?.urlRegExp ?? "")) })
+    ),
+  });
 
   const updateDefaultAppMutation = trpc.viewer.updateUserDefaultConferencingApp.useMutation({
     onSuccess: () => {
       showToast("Default app updated successfully", "success");
       utils.viewer.getUsersDefaultConferencingApp.invalidate();
     },
+    onError: () => {
+      showToast(`Invalid App Link Format`, "error");
+    },
   });
 
   return (
diff --git a/packages/trpc/server/routers/viewer.tsx b/packages/trpc/server/routers/viewer.tsx
index 8a664e26ec..ffa9e944da 100644
--- a/packages/trpc/server/routers/viewer.tsx
+++ b/packages/trpc/server/routers/viewer.tsx
@@ -1192,6 +1192,26 @@ const loggedInViewerRouter = router({
     )
     .mutation(async ({ ctx, input }) => {
       const currentMetadata = userMetadata.parse(ctx.user.metadata);
+      const credentials = ctx.user.credentials;
+      const foundApp = getApps(credentials).filter((app) => app.slug === input.appSlug)[0];
+      const appLocation = foundApp?.appData?.location;
+
+      if (!foundApp || !appLocation)
+        throw new TRPCError({ code: "BAD_REQUEST", message: "App not installed" });
+
+      if (appLocation.linkType === "static" && !input.appLink) {
+        throw new TRPCError({ code: "BAD_REQUEST", message: "App link is required" });
+      }
+
+      if (appLocation.linkType === "static" && appLocation.urlRegExp) {
+        const validLink = z
+          .string()
+          .regex(new RegExp(appLocation.urlRegExp), "Invalid App Link")
+          .parse(input.appLink);
+        if (!validLink) {
+          throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid app link" });
+        }
+      }
 
       await ctx.prisma.user.update({
         where: {