From 2f17534394b3c69700fb60e467cf54e6231e5c5e Mon Sep 17 00:00:00 2001
From: tzhangchi <terry.zhangchi@outlook.com>
Date: Wed, 17 Aug 2022 10:37:04 +0800
Subject: [PATCH] fix(figma): Incomplete URL substring sanitization

---
 libs/components/editor-blocks/src/blocks/figma/index.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libs/components/editor-blocks/src/blocks/figma/index.ts b/libs/components/editor-blocks/src/blocks/figma/index.ts
index b3e0b76b8d..3ed44c9c85 100644
--- a/libs/components/editor-blocks/src/blocks/figma/index.ts
+++ b/libs/components/editor-blocks/src/blocks/figma/index.ts
@@ -1,9 +1,9 @@
+import { Protocol } from '@toeverything/datasource/db-service';
 import {
     AsyncBlock,
     BaseView,
     SelectBlock,
 } from '@toeverything/framework/virgo';
-import { Protocol, services } from '@toeverything/datasource/db-service';
 import { FigmaView } from './FigmaView';
 
 export class FigmaBlock extends BaseView {
@@ -19,7 +19,10 @@ export class FigmaBlock extends BaseView {
         const tag_name = el.tagName;
         if (tag_name === 'A' && el.parentElement?.childElementCount === 1) {
             const href = el.getAttribute('href');
-            if (href.indexOf('.figma.com') !== -1) {
+            const allowedHosts = ['www.figma.com'];
+            const host = new URL(href).host;
+
+            if (allowedHosts.includes(host)) {
                 return [
                     {
                         type: this.type,