Merge pull request from GHSA-564w-97r7-c6p9

lib/livebook/utils.ex

@@ -307,6 +307,25 @@ defmodule Livebook.Utils do
     "data:#{mime};base64,#{data}"
   end
 
+  @doc """
+  Expands URL received from the Desktop App for opening in the browser.
+  """
+  def expand_desktop_url("") do
+    LivebookWeb.Endpoint.access_url()
+  end
+
+  def expand_desktop_url("/settings") do
+    to_string(%{LivebookWeb.Endpoint.access_struct_url() | path: "/settings"})
+  end
+
+  def expand_desktop_url("file://" <> path) do
+    notebook_open_url(path)
+  end
+
+  def expand_desktop_url("livebook://" <> rest) do
+    notebook_import_url("https://#{rest}")
+  end
+
   @doc """
   Opens the given `url` in the browser.
   """
@@ -323,10 +342,15 @@ defmodule Livebook.Utils do
 
         {:unix, _} ->
           cond do
-            System.find_executable("xdg-open") -> {"xdg-open", [url]}
+            System.find_executable("xdg-open") ->
+              {"xdg-open", [url]}
+
             # When inside WSL
-            System.find_executable("cmd.exe") -> {"cmd.exe", win_cmd_args}
+            System.find_executable("cmd.exe") ->
-            true -> nil
+              {"cmd.exe", win_cmd_args}
+
+            true ->
+              nil
           end
       end
 

lib/livebook_app.ex

@@ -18,7 +18,10 @@ if Mix.target() == :app do
 
     @impl true
     def handle_info({:event, "open", url}, state) do
-      open(url)
+      url
+      |> Livebook.Utils.expand_desktop_url()
+      |> Livebook.Utils.browser_open()
+
       {:noreply, state}
     end
 
@@ -27,31 +30,5 @@ if Mix.target() == :app do
       Livebook.Config.shutdown()
       {:noreply, state}
     end
-
-    defp open("") do
-      open(LivebookWeb.Endpoint.access_url())
-    end
-
-    defp open("file://" <> path) do
-      path
-      |> Livebook.Utils.notebook_open_url()
-      |> open()
-    end
-
-    defp open("livebook://" <> rest) do
-      "https://#{rest}"
-      |> Livebook.Utils.notebook_import_url()
-      |> open()
-    end
-
-    defp open("/settings") do
-      %{LivebookWeb.Endpoint.access_struct_url() | path: "/settings"}
-      |> to_string()
-      |> open()
-    end
-
-    defp open(url) do
-      Livebook.Utils.browser_open(url)
-    end
   end
 end

test/livebook/utils_test.exs

@@ -1,4 +1,48 @@
 defmodule Livebook.UtilsTest do
   use ExUnit.Case, async: true
   doctest Livebook.Utils
+
+  describe "expand_desktop_url/1" do
+    test "empty url" do
+      assert Livebook.Utils.expand_desktop_url("") == "http://localhost:4002/"
+    end
+
+    test "/settings" do
+      assert Livebook.Utils.expand_desktop_url("/settings") ==
+               "http://localhost:4002/settings"
+    end
+
+    test "file://" do
+      assert Livebook.Utils.expand_desktop_url("file://c/foo.txt") ==
+               "http://localhost:4002/open?path=c%2Ffoo.txt"
+
+      assert Livebook.Utils.expand_desktop_url("file://c/../../../foo.txt") ==
+               "http://localhost:4002/open?path=c%2F..%2F..%2F..%2Ffoo.txt"
+
+      assert Livebook.Utils.expand_desktop_url("file://c\\foo.txt") ==
+               "http://localhost:4002/open?path=c%5Cfoo.txt"
+    end
+
+    test "livebook://" do
+      assert Livebook.Utils.expand_desktop_url("livebook://github.com/a/b/blob/main/a.livemd") ==
+               "http://localhost:4002/import?url=https%3A%2F%2Fgithub.com%2Fa%2Fb%2Fblob%2Fmain%2Fa.livemd"
+
+      assert Livebook.Utils.expand_desktop_url("livebook://github.com/../../../a.livemd") ==
+               "http://localhost:4002/import?url=https%3A%2F%2Fgithub.com%2F..%2F..%2F..%2Fa.livemd"
+    end
+
+    test "other urls" do
+      assert_raise FunctionClauseError, fn ->
+        Livebook.Utils.expand_desktop_url("file:a.txt")
+      end
+
+      assert_raise FunctionClauseError, fn ->
+        Livebook.Utils.expand_desktop_url("livebook:a.txt")
+      end
+
+      assert_raise FunctionClauseError, fn ->
+        Livebook.Utils.expand_desktop_url("a.txt")
+      end
+    end
+  end
 end