chore: coderabbit feedback

Author: elibosley

web/components/UpdateOs/ChangelogModal.vue

@@ -16,6 +16,7 @@ import type { ComposerTranslation } from 'vue-i18n';
 import RawChangelogRenderer from '~/components/UpdateOs/RawChangelogRenderer.vue';
 import { usePurchaseStore } from '~/store/purchase';
 import { useUpdateOsStore } from '~/store/updateOs';
+import { allowedDocsOriginRegex, allowedDocsUrlRegex } from '~/helpers/urls';
 
 export interface Props {
   open?: boolean;
@@ -54,14 +55,19 @@ const handleIframeNavigationMessage = (event: MessageEvent) => {
     event.data.type === 'unraid-docs-navigation' &&
     iframeRef.value &&
     event.source === iframeRef.value.contentWindow &&
-    event.origin === 'https://docs.unraid.net'
+    allowedDocsOriginRegex.test(event.origin)
   ) {
-    if (event.data.url !== docsChangelogUrl.value) {
-      hasNavigated.value = true;
-    } else {
-      hasNavigated.value = false;
+    if (
+      typeof event.data.url === 'string' &&
+      allowedDocsUrlRegex.test(event.data.url)
+    ) {
+      if (event.data.url !== docsChangelogUrl.value) {
+        hasNavigated.value = true;
+      } else {
+        hasNavigated.value = false;
+      }
+      currentIframeUrl.value = event.data.url;
     }
-    currentIframeUrl.value = event.data.url;
   }
 };
 

web/components/UpdateOs/RawChangelogRenderer.vue

@@ -29,7 +29,11 @@ const fetchAndParseChangelog = async () => {
   parseChangelogFailed.value = "";
   try {
     // Fetch the changelog content from the URL
-    const data = await fetch(props.changelog).then(r => r.text());
+    const res = await fetch(props.changelog);
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status} while fetching changelog`);
+    }
+    const data = await res.text();
     if (!data || data.trim() === "") {
       parseChangelogFailed.value = 'Changelog is empty';
       isLoading.value = false;

web/helpers/urls.ts

@@ -40,6 +40,9 @@ const DOCS_REGISTRATION_REPLACE_KEY = new URL('/go/changing-the-flash-device/',
 
 const SUPPORT = new URL('https://unraid.net');
 
+export const allowedDocsOriginRegex = /^https:\/\/(?:[\w-]+\.)*docs\.unraid\.net(?::\d+)?$/;
+export const allowedDocsUrlRegex = /^https:\/\/(?:[\w-]+\.)*docs\.unraid\.net(?::\d+)?\//;
+
 export {
   ACCOUNT,
   ACCOUNT_CALLBACK,