Add URL Validation and Security Headers (#42)

* add reCAPTCHA validation and profile link checks in user profile routes

* URL Validation

* Add Security Headers

* remove

* add goomgle

Author: jayantkageri

app/api/registration/route.ts

@@ -23,20 +23,33 @@ const validateAge = (age: string) => {
   const ageNum = parseInt(age);
   return !isNaN(ageNum) && ageNum > 0 && ageNum < 120;
 };
-const validateURL = (url: string) => {
+
+const isValidLinkUrl = (value: unknown): boolean => {
+  if (value === undefined || value === null) return true;
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed) return true;
+  let parsed: URL;
   try {
-    const parsedUrl = new URL(url);
-    // Check for valid hostname (at least one dot and valid characters)
-    if (
-      !parsedUrl.hostname.includes(".") ||
-      !/^[a-zA-Z0-9.-]+$/.test(parsedUrl.hostname)
-    ) {
-      return false;
-    }
-    return true;
+    parsed = new URL(trimmed);
   } catch {
     return false;
   }
+  return (
+    (parsed.protocol === "https:" || parsed.protocol === "http:") &&
+    parsed.hostname.includes(".") &&
+    /^[a-zA-Z0-9.-]+$/.test(parsed.hostname)
+  );
+};
+
+const isValidLinkDomain = (value: unknown, domains: string[]): boolean => {
+  if (value === undefined || value === null) return true;
+  if (typeof value !== "string" || !value.trim()) return true;
+  if (!isValidLinkUrl(value)) return false;
+  const host = new URL(value.trim()).hostname
+    .toLowerCase()
+    .replace(/^www\./, "");
+  return domains.some((d) => host === d || host.endsWith(`.${d}`));
 };
 const validateReferralCode = (code: string) => {
   const referralCodesEnv = process.env.VALID_REFERRAL_CODES || "";
@@ -216,7 +229,7 @@ export async function POST(request: Request) {
           message: "Too many requests. Please try again later.",
           error: "Rate limit exceeded",
         },
-        { status: 429 }
+        { status: 429 },
       );
     }
 
@@ -239,7 +252,11 @@ export async function POST(request: Request) {
     // the score + action, before any Firebase/Cloudinary/DB writes.
     const captcha = await verifyRecaptcha(recaptcha_token, "register");
     if (!captcha.ok) {
-      console.warn("[registration] reCAPTCHA rejected:", captcha.reason, captcha.score);
+      console.warn(
+        "[registration] reCAPTCHA rejected:",
+        captcha.reason,
+        captcha.score,
+      );
       return NextResponse.json(
         {
           message: "reCAPTCHA validation failed",
@@ -390,18 +407,23 @@ export async function POST(request: Request) {
     }
 
     // Validate password (min 8 chars, 1 uppercase, 1 lowercase, 1 number, 1 special char)
-    const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;
+    const passwordRegex =
+      /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;
     if (!passwordRegex.test(password)) {
       return NextResponse.json(
         {
-          message: "Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.",
+          message:
+            "Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.",
           error: "Weak password",
         },
         { status: 400 },
       );
     }
 
-    if (data.github_link && !validateURL(data.github_link)) {
+    if (
+      data.github_link &&
+      !isValidLinkDomain(data.github_link, ["github.com"])
+    ) {
       return NextResponse.json(
         {
           message: "Invalid GitHub profile URL format.",
@@ -411,7 +433,10 @@ export async function POST(request: Request) {
       );
     }
 
-    if (data.linkedin_link && !validateURL(data.linkedin_link)) {
+    if (
+      data.linkedin_link &&
+      !isValidLinkDomain(data.linkedin_link, ["linkedin.com"])
+    ) {
       return NextResponse.json(
         {
           message: "Invalid LinkedIn profile URL format.",
@@ -421,7 +446,7 @@ export async function POST(request: Request) {
       );
     }
 
-    if (data.ctf_profile && !validateURL(data.ctf_profile)) {
+    if (data.ctf_profile && !isValidLinkUrl(data.ctf_profile)) {
       return NextResponse.json(
         {
           message: "Invalid CTF profile URL format.",
@@ -431,7 +456,7 @@ export async function POST(request: Request) {
       );
     }
 
-    if (data.portfolio_link && !validateURL(data.portfolio_link)) {
+    if (data.portfolio_link && !isValidLinkUrl(data.portfolio_link)) {
       return NextResponse.json(
         {
           message: "Invalid Portfolio URL format.",

app/api/user/register/route.ts

@@ -38,13 +38,33 @@ const validatePassword = (password: string) => {
   if (!/[^A-Za-z0-9]/.test(password)) return false;
   return true;
 };
-const validateURL = (url: string) => {
+
+const isValidLinkUrl = (value: unknown): boolean => {
+  if (value === undefined || value === null) return true;
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed) return true;
+  let parsed: URL;
   try {
-    new URL(url);
-    return true;
+    parsed = new URL(trimmed);
   } catch {
     return false;
   }
+  return (
+    (parsed.protocol === "https:" || parsed.protocol === "http:") &&
+    parsed.hostname.includes(".") &&
+    /^[a-zA-Z0-9.-]+$/.test(parsed.hostname)
+  );
+};
+
+const isValidLinkDomain = (value: unknown, domains: string[]): boolean => {
+  if (value === undefined || value === null) return true;
+  if (typeof value !== "string" || !value.trim()) return true;
+  if (!isValidLinkUrl(value)) return false;
+  const host = new URL(value.trim()).hostname
+    .toLowerCase()
+    .replace(/^www\./, "");
+  return domains.some((d) => host === d || host.endsWith(`.${d}`));
 };
 
 // Upload base64 file to Cloudinary
@@ -269,16 +289,16 @@ export async function POST(request: Request) {
     }
 
     // Optional URL validations
-    if (github_link && !validateURL(github_link)) {
+    if (github_link && !isValidLinkDomain(github_link, ["github.com"])) {
       errors.github_link = "Invalid GitHub URL";
     }
-    if (linkedin_link && !validateURL(linkedin_link)) {
+    if (linkedin_link && !isValidLinkDomain(linkedin_link, ["linkedin.com"])) {
       errors.linkedin_link = "Invalid LinkedIn URL";
     }
-    if (portfolio_link && !validateURL(portfolio_link)) {
+    if (portfolio_link && !isValidLinkUrl(portfolio_link)) {
       errors.portfolio_link = "Invalid portfolio URL";
     }
-    if (ctf_profile && !validateURL(ctf_profile)) {
+    if (ctf_profile && !isValidLinkUrl(ctf_profile)) {
       errors.ctf_profile = "Invalid CTF profile URL";
     }
 

next.config.js

@@ -1,3 +1,18 @@
+const contentSecurityPolicy = [
+  "default-src 'self'",
+  "base-uri 'self'",
+  "object-src 'none'",
+  "frame-ancestors 'self'",
+  "form-action 'self'",
+  "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com https://www.gstatic.com https://apis.google.com",
+  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+  "font-src 'self' data: https://fonts.gstatic.com",
+  "img-src 'self' data: blob: https://res.cloudinary.com https://firebasestorage.googleapis.com https://*.googleusercontent.com https://www.gstatic.com",
+  "connect-src 'self' https://*.googleapis.com https://*.firebaseio.com wss://*.firebaseio.com https://*.firebaseapp.com https://apis.google.com https://accounts.google.com https://cdn.jsdelivr.net https://www.google.com",
+  "frame-src 'self' https://www.google.com https://*.firebaseapp.com https://accounts.google.com https://apis.google.com",
+  "worker-src 'self' blob:",
+].join("; ");
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   eslint: {
@@ -32,6 +47,8 @@ const nextConfig = {
         source: '/:path*',
         headers: [
           { key: 'Strict-Transport-Security', value: "max-age=63072000" },
+          { key: 'Content-Security-Policy', value: contentSecurityPolicy },
+          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
           { key: 'Access-Control-Allow-Origin', value: process.env.NEXT_PUBLIC_DOMAIN },
           { key: 'Access-Control-Allow-Credentials', value: 'true' },
           { key: 'Access-Control-Allow-Methods', value: "GET,POST,PUT,PATCH,DELETE,OPTIONS" },