From 0a23be45791b04b74ff9062b7e2905cf357c7387 Mon Sep 17 00:00:00 2001
From: Hariom Balhara <hariombalhara@gmail.com>
Date: Tue, 25 Oct 2022 13:48:19 +0530
Subject: [PATCH] Ensure the URL is absolute before checking the origin (#5194)

---
 packages/app-store/_utils/useAddAppMutation.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/app-store/_utils/useAddAppMutation.ts b/packages/app-store/_utils/useAddAppMutation.ts
index 228f4846c6..b9ea8bbb69 100644
--- a/packages/app-store/_utils/useAddAppMutation.ts
+++ b/packages/app-store/_utils/useAddAppMutation.ts
@@ -44,10 +44,13 @@ function useAddAppMutation(_type: App["type"] | null, options?: Parameters<typeo
       window.location.href = json.url;
       return;
     }
+
     // Skip redirection only if it is an OmniInstall and redirect URL isn't of some other origin
     // This allows installation of apps like Stripe to still redirect to their authentication pages.
-    // TODO: For Omni installation to authenticate and come back to the page where installation was initiated, some changes need to be done in all apps' add callbacks
-    if (!json.url.startsWith(window.location.origin)) {
+
+    // Check first that the URL is absolute, then check that it is of different origin from the current.
+    if (/https?:\/\//.test(json.url) && !json.url.startsWith(window.location.origin)) {
+      // TODO: For Omni installation to authenticate and come back to the page where installation was initiated, some changes need to be done in all apps' add callbacks
       window.location.href = json.url;
     }
   }, options);