MWPW-192736: Add check for milolibs query param

acrobat/blocks/unity/unity.js

@@ -98,6 +98,7 @@ function getUnityLibs(prodLibs = '/unitylibs') {
   if (!/\.hlx\.|\.aem\.|local|stage/.test(hostname)) return prodLibs;
   // eslint-disable-next-line compat/compat
   const branch = new URLSearchParams(search).get('unitylibs') || 'main';
+  if (!/^[a-zA-Z0-9_-]+$/.test(branch)) throw new Error('Invalid branch name.');
   if (branch === 'main' && hostname === 'www.stage.adobe.com') return prodLibs;
   const env = hostname.includes('.aem.') ? 'aem' : 'hlx';
   return `https://${branch}${branch.includes('--') ? '' : '--unity--adobecom'}.${env}.live/unitylibs`;

acrobat/scripts/scripts.js

@@ -26,6 +26,7 @@ const setLibs = (prodLibs, location = window.location) => {
   if (!/\.hlx\.|\.aem\.|local|stage/.test(hostname)) return prodLibs;
   // eslint-disable-next-line compat/compat
   const branch = new URLSearchParams(search).get('milolibs') || 'main';
+  if (!/^[a-zA-Z0-9_-]+$/.test(branch)) throw new Error('Invalid branch name.');
   if (branch === 'main' && hostname === 'www.stage.adobe.com') return '/libs';
   if (branch === 'local') return 'http://localhost:6456/libs';
   return `https://${branch}${branch.includes('--') ? '' : '--milo--adobecom'}.aem.live/libs`;

acrobat/scripts/utils.js

@@ -28,6 +28,7 @@ export const [setLibs, getLibs] = (() => {
         if (!/\.hlx\.|\.aem\.|local|stage/.test(hostname)) return prodLibs;
         // eslint-disable-next-line compat/compat
         const branch = new URLSearchParams(search).get('milolibs') || 'main';
+        if (!/^[a-zA-Z0-9_-]+$/.test(branch)) throw new Error('Invalid branch name.');
         if (branch === 'main' && hostname === 'www.stage.adobe.com') return '/libs';
         if (branch === 'local') return 'http://localhost:6456/libs';
         return `https://${branch}${branch.includes('--') ? '' : '--milo--adobecom'}.aem.live/libs`;

head.html

@@ -9,6 +9,7 @@
     const { hostname, search } = location;
     if (!/\.hlx\.|\.aem\.|local|stage/.test(hostname)) return prodLibs;
     const branch = new URLSearchParams(search).get('milolibs') || 'main';
+    if (!/^[a-zA-Z0-9_-]+$/.test(branch)) throw new Error('Invalid branch name.');
     if (branch === 'main' && hostname === 'www.stage.adobe.com') return '/libs';
     if (branch === 'local') return 'http://localhost:6456/libs';
     const env = hostname.includes('.hlx.') ? 'hlx' : 'aem';
@@ -19,6 +20,7 @@
     const { hostname, search } = window.location;
     if (!/\.hlx\.|\.aem\.|local|stage/.test(hostname)) return prodLibs;
     const branch = new URLSearchParams(search).get('unitylibs') || 'main';
+    if (!/^[a-zA-Z0-9_-]+$/.test(branch)) throw new Error('Invalid branch name.');
     if (branch === 'main' && hostname === 'www.stage.adobe.com') return prodLibs;
     const env = hostname.includes('.hlx.') ? 'hlx' : 'aem';
     return `https://${branch}${branch.includes('--')? '' : '--unity--adobecom'}.${env}.live/unitylibs`;