Task/validate and encode URL in logo endpoint (#7330)

* Harden URL validation in logo endpoint

* Update changelog

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Hardened the validation of the URL in the logo endpoint
 - Set the change detection strategy to `OnPush` in the about pages
 - Set the change detection strategy to `OnPush` in the accounts page
 - Set the change detection strategy to `OnPush` in the demo page

apps/api/src/app/logo/get-logo.dto.ts

@@ -0,0 +1,9 @@
+import { IsUrl } from 'class-validator';
+
+export class GetLogoDto {
+  @IsUrl({
+    protocols: ['http', 'https'],
+    require_protocol: true
+  })
+  url: string;
+}

apps/api/src/app/logo/logo.controller.ts

@@ -12,6 +12,7 @@ import {
 import { DataSource } from '@prisma/client';
 import { Response } from 'express';
 
+import { GetLogoDto } from './get-logo.dto';
 import { LogoService } from './logo.service';
 
 @Controller('logo')
@@ -41,7 +42,7 @@ export class LogoController {
 
   @Get()
   public async getLogoByUrl(
-    @Query('url') url: string,
+    @Query() { url }: GetLogoDto,
     @Res() response: Response
   ) {
     try {

apps/api/src/app/logo/logo.service.ts

@@ -47,7 +47,7 @@ export class LogoService {
   private async getBuffer(aUrl: string) {
     const blob = await this.fetchService
       .fetch(
-        `https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=${aUrl}&size=64`,
+        `https://t0.gstatic.com/faviconV2?client=SOCIAL&fallback_opts=TYPE,SIZE,URL&size=64&type=FAVICON&url=${encodeURIComponent(aUrl)}`,
         {
           headers: { 'User-Agent': 'request' },
           signal: AbortSignal.timeout(

libs/ui/src/lib/entity-logo/entity-logo-image-source.service.ts

@@ -15,6 +15,6 @@ export class EntityLogoImageSourceService {
   }
 
   public getLogoUrlByUrl(url: string) {
-    return `../api/v1/logo?url=${url}`;
+    return `../api/v1/logo?url=${encodeURIComponent(url)}`;
   }
 }