fix: use registrable domain for isSameDomain/isSameSubdomain (multi-part TLDs) - #4443
fix: use registrable domain for isSameDomain/isSameSubdomain (multi-part TLDs)#4443eeshsaxena wants to merge 1 commit into
Conversation
isSameDomain and isSameSubdomain derived the domain from the last two hostname labels, which is wrong for multi-part public suffixes: foo.co.uk and bar.co.uk both reduced to co.uk and compared equal, as did a.github.io and b.github.io. These gate the /map endpoint's same-domain filter (map-utils.ts, v1 map controller), so a map of a site on such a suffix could include URLs from other sites sharing the suffix. Use parseHostname (tldts, public-suffix aware) for the registrable domain and subdomain, which is already how the rest of the codebase resolves domains. A leading www. is still ignored. Adds tests for the multi-part-suffix cases.
|
The user-facing impact is on /map: because these gate the same-domain filter, mapping a site on a shared suffix (a github.io project page, a co.uk or com.au site, a vercel.app deployment) can surface URLs from other sites under that suffix. The fix reuses parseHostname/tldts, which the codebase already relies on for registrable domains, so it stays consistent with url-utils. |
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/api/src/lib/validateUrl.ts">
<violation number="1" location="apps/api/src/lib/validateUrl.ts:85">
P2: The new `domain1 !== null` guard makes `isSameDomain` (and `isSameSubdomain`) return `false` for identical IP-address or single-label hosts. tldts returns `domain: null` for IPs (e.g. `127.0.0.1`) and for hosts with no public-suffix match (e.g. `localhost`), so `isSameDomain("http://127.0.0.1", "http://127.0.0.1")` flips from `true` (old last-two-labels logic: `"1.1" === "1.1"`) to `false`. Since these functions gate the `/map` same-domain filter, a site hosted on a raw IP would no longer match its own links. Consider falling back to comparing the full hostnames when the registrable domain is null.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
| .join("."); | ||
|
|
||
| return domain1 === domain2; | ||
| return domain1 !== null && domain1 === domain2; |
There was a problem hiding this comment.
P2: The new domain1 !== null guard makes isSameDomain (and isSameSubdomain) return false for identical IP-address or single-label hosts. tldts returns domain: null for IPs (e.g. 127.0.0.1) and for hosts with no public-suffix match (e.g. localhost), so isSameDomain("http://127.0.0.1", "http://127.0.0.1") flips from true (old last-two-labels logic: "1.1" === "1.1") to false. Since these functions gate the /map same-domain filter, a site hosted on a raw IP would no longer match its own links. Consider falling back to comparing the full hostnames when the registrable domain is null.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/lib/validateUrl.ts, line 85:
<comment>The new `domain1 !== null` guard makes `isSameDomain` (and `isSameSubdomain`) return `false` for identical IP-address or single-label hosts. tldts returns `domain: null` for IPs (e.g. `127.0.0.1`) and for hosts with no public-suffix match (e.g. `localhost`), so `isSameDomain("http://127.0.0.1", "http://127.0.0.1")` flips from `true` (old last-two-labels logic: `"1.1" === "1.1"`) to `false`. Since these functions gate the `/map` same-domain filter, a site hosted on a raw IP would no longer match its own links. Consider falling back to comparing the full hostnames when the registrable domain is null.</comment>
<file context>
@@ -73,23 +74,15 @@ export function isSameDomain(url: string, baseUrl: string) {
- .join(".");
-
- return domain1 === domain2;
+ return domain1 !== null && domain1 === domain2;
}
</file context>
Problem
isSameDomainandisSameSubdomainderive the domain from the last two hostname labels (hostname.split(".").slice(-2)). That is wrong for multi-part public suffixes:foo.co.ukandbar.co.ukboth reduce toco.uk→ reported as the same domaina.github.ioandb.github.io→ samex.vercel.app/y.vercel.app,*.com.au,*.pages.dev, etc. → sameThese two functions gate the
/mapendpoint's same-domain filter (lib/map-utils.tsand the v1 map controller filtermapResults/linkswithisSameDomain/isSameSubdomain). So a map of a site hosted on such a suffix (e.g. a*.github.ioproject page, a.co.uksite) can include URLs from other people's sites sharing the suffix.isSameSubdomainhas the same defect in both its domain and subdomain computation (sub.example.co.uksplit its domain asco.ukand its subdomain assub.example).Fix
Use
parseHostname(tldts, public-suffix aware) for the registrable domain and subdomain — the helper the rest of the codebase already uses for exactly this (seelib/url-utils.ts, which documents theallowPrivateDomainsoption so hosting suffixes likevercel.appare handled). A leadingwww.is still ignored in the subdomain comparison.Testing
All existing
isSameDomain/isSameSubdomaincases still pass, and I added tests for the multi-part-suffix cases. I verified the fixed logic against every existing test input plus the suffix cases by running it againsttldtsdirectly (the resolver the fix uses); the full API test suite runs in CI.Summary by cubic
Fixes
isSameDomainandisSameSubdomainto use the public-suffix-aware registrable domain instead of the last two hostname labels, so the/mapendpoint no longer treatsfoo.co.ukandbar.co.uk(ora.github.ioandb.github.io) as the same site. Both functions now useparseHostnamefromlib/url-utils, and a leadingwww.is still ignored in subdomain comparisons. Adds tests for multi-part suffix cases.Written for commit c973250. Summary will update on new commits.