MM-41042: Allow trusted plugin routes (#1956)

* Allow trusted plugin routes

The only allowed plugin route is, for now, the export endpoint for the
channel export plugin.

* Keep it simple

src/common/utils/url.ts

@@ -204,6 +204,10 @@ function isCustomLoginURL(url: URL | string, server: ServerFromURL, teams: TeamW
     return false;
 }
 
+function isChannelExportUrl(serverUrl: URL | string, inputUrl: URL | string): boolean {
+    return isUrlType('plugins/com.mattermost.plugin-channel-export/api/v1/export', serverUrl, inputUrl);
+}
+
 export default {
     isValidURL,
     isValidURI,
@@ -218,4 +222,5 @@ export default {
     getHost,
     isTrustedURL,
     isCustomLoginURL,
+    isChannelExportUrl,
 };

src/main/views/webContentEvents.test.js

@@ -55,6 +55,7 @@ jest.mock('common/utils/url', () => ({
     isValidURI: jest.fn(),
     isPluginUrl: jest.fn(),
     isManagedResource: jest.fn(),
+    isChannelExportUrl: jest.fn(),
 }));
 
 jest.mock('../../../electron-builder.json', () => ({
@@ -124,6 +125,12 @@ describe('main/views/webContentsEvents', () => {
             expect(event.preventDefault).not.toBeCalled();
         });
 
+        it('should allow navigation when it isChannelExportUrl', () => {
+            urlUtils.isChannelExportUrl.mockImplementation((serverURL, parsedURL) => parsedURL.toString().includes('/plugins/com.mattermost.plugin-channel-export/api/v1/export'));
+            willNavigate(event, 'http://server-1.com/plugins/com.mattermost.plugin-channel-export/api/v1/export');
+            expect(event.preventDefault).not.toBeCalled();
+        });
+
         it('should not allow navigation under any other circumstances', () => {
             willNavigate(event, 'http://someotherurl.com');
             expect(event.preventDefault).toBeCalled();

src/main/views/webContentEvents.ts

@@ -56,6 +56,10 @@ export class WebContentsEventManager {
                 return;
             }
 
+            if (server && urlUtils.isChannelExportUrl(server.url, parsedURL)) {
+                return;
+            }
+
             if (server && urlUtils.isCustomLoginURL(parsedURL, server, configServers)) {
                 return;
             }