From 59bd31b07ddd702a6d2978a7bec1a66775eddfb8 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Thu, 21 Aug 2025 14:40:46 +0530
Subject: [PATCH] fix: URL sanitizer

---
 app/javascript/sdk/IFrameHelper.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/javascript/sdk/IFrameHelper.js b/app/javascript/sdk/IFrameHelper.js
index 25f90912d..15c96d0f4 100644
--- a/app/javascript/sdk/IFrameHelper.js
+++ b/app/javascript/sdk/IFrameHelper.js
@@ -60,15 +60,16 @@ const sanitizeURL = url => {
     const parsedURL = new URL(url);
 
     // filter out dangerous protocols like `javascript`, `data`, `vbscript`
-    if (!['https', 'http'].includes(parsedURL.protocol)) {
+    if (!['https:', 'http:'].includes(parsedURL.protocol)) {
       throw new Error('Invalid Protocol');
     }
+
+    return url; // Return the original valid URL
   } catch (e) {
     // eslint-disable-next-line no-console
     console.error('Invalid URL', e);
+    return 'about:blank'; // Only return blank for invalid URLs
   }
-
-  return 'about:blank'; // blank page URL
 };
 
 export const IFrameHelper = {