Pedro CastroandGitHub d9aef5b6a6 fix: add URL validation for logo fields (#26522) ...

* fix(auth): add URL validation for organization logo fields

- Add URL validation utility for server-side fetched URLs
- Validate logo URLs in tRPC organization schema
- Validate logo URLs in API v2 team DTOs
- Add graceful fallback in logo route for invalid URLs
- Only allow HTTPS and image data URLs
- Add unit tests for URL validation

* fix: add missing IP range and type validation

- Add RFC 6598 CGNAT range (100.64.0.0/10) to blocked IPs
- Add @IsString() decorator before custom URL validators
- Add boundary tests for new IP range

* fix: address review feedback

   - Export validateUrlForSSRFSync via @calcom/platform-libraries
   - Fix nullable/optional order in Zod schema

* fix: block localhost hostname and explicit null check

- Add localhost to BLOCKED_HOSTNAMES for sync validation
- Use explicit null check (url == null) instead of falsy check

* fix: allow empty string in URL validation

* refactor: extract shared validation logic

- Extract validateUrlCore() to eliminate duplication between sync/async versions
- Add JSDoc to all exported functions for better discoverability
- Remove redundant comments that repeated function names
- Simplify existing comments to be more concise

* fix: reject empty strings in URL validator

Previously if (!url) allowed empty strings to bypass validation.
Now explicitly checks for null/undefined only

2026-01-08 22:03:54 +00:00

..

__mocks__

feat: Round Robin groups (#22296)

2025-08-08 12:56:13 +01:00

__tests__

feat: add time shift badge for recurring events with shifted local times (#25568)

2025-12-11 20:18:00 +00:00

apps

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

auth

refactor: remove @calcom/features dependency from @calcom/prisma (#23820)

2025-09-18 16:40:39 +00:00

bookings

feat: Include booking question response in csv file from insights page (#25454)

2025-12-10 14:51:09 +00:00

browser

fix: Scrolling to timeslot issue on Safari with inline-embeds (#22547)

2025-07-23 04:26:08 -03:00

builders/CalendarEvent

feat: Disable booking emails to guests (#25217)

2025-12-03 17:21:31 +00:00

components

fix: correct typos and HTML encoding in org invite emails (#25551)

2025-12-04 19:53:44 +00:00

crmManager

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

cva

fix: typos in several package/ directories (#19495)

2025-02-24 14:44:08 +00:00

dayjs

fix: Update timeZoneSchema to handle +00:00 timezone case and maintain IANA compliance (#25776)

2025-12-11 19:46:13 +00:00

domainManager

fix: improve Vercel domain 'forbidden' error message and add schema fields (#25520)

2025-12-05 05:26:42 +00:00

holidays

feat(holidays): improve UI/UX and add contextual emojis (#25895)

2025-12-16 00:40:04 +00:00

hooks

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

idempotencyKey

fix: Generate new idempotency key when round robin reassigning (#22065)

2025-06-26 17:43:31 +00:00

intervalLimits

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

payment

refactor: circular deps between app store and lib [3] (#23742)

2025-09-14 11:24:16 -03:00

raqb

refactor: Move attribute and routing-forms code from app-store/lib to features (#26025)

2025-12-29 21:51:06 -03:00

schedules/transformers

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

server

refactor: remove @calcom/web imports from @calcom/features and add @calcom/testing package (#26480)

2026-01-08 16:59:11 +09:00

service

refactor: Move attribute and routing-forms code from app-store/lib to features (#26025)

2025-12-29 21:51:06 -03:00

sync

chore: Cleanup Close.com (#16929)

2024-11-13 15:14:31 -05:00

tasker

feat: Booking EmailAndSms Notifications Tasker (#24944)

2025-11-28 14:00:04 +00:00

test

feat: add webhook versioning (#23861)

2025-12-18 09:36:22 +02:00

tracing

feat: distributed tracing - 2 (#24861)

2025-11-13 11:51:54 +00:00

tracking

feat: store ads clickid when creating an account (#25763)

2025-12-22 23:29:51 +05:30

unstable_cache

perf: server-fetch data for all pages in /settings/my-account (#20712)

2025-07-24 22:36:40 +01:00

zod

fix: add URL validation for logo fields (#26522)

2026-01-08 22:03:54 +00:00

array.test.ts

feat: Support event level conflict checking (#18052)

2024-12-19 19:34:24 +00:00

array.ts

feat: Support event level conflict checking (#18052)

2024-12-19 19:34:24 +00:00

availability.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

buildCalEventFromBooking.ts

feat: Disable booking emails to guests (#25217)

2025-12-03 17:21:31 +00:00

CalendarAppError.ts

chore: rename DWD to DelegationCredential (#19744)

2025-03-05 10:42:20 -03:00

CalendarService.ts

refactor: replace shouldServeCache with mode parameter for calendar cache control (#26539)

2026-01-08 09:07:41 -03:00

CalEventParser.test.ts

feat: Upgrade to Next 15 (#18834)

2025-03-20 21:30:51 -03:00

CalEventParser.ts

fix: preserve newlines and links in calendar event descriptions (#25868)

2025-12-17 15:02:12 +00:00

checkIfItFallbackImage.ts

fix avatar remove button (#12249)

2023-11-15 15:23:33 +05:30

checkRateLimitAndThrowError.test.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

checkRateLimitAndThrowError.ts

chore: system wide ratelimit per path (#25080)

2025-11-12 22:01:59 +00:00

CloseCom.ts

fix: typos in several package/ directories (#19495)

2025-02-24 14:44:08 +00:00

CloseComeUtils.ts

refactor: Introduce crmManager (#14272)

2024-05-31 13:54:52 +00:00

connectedCalendar.ts

feat: Support event level conflict checking (#18052)

2024-12-19 19:34:24 +00:00

constants.ts

feat: add session endpoint and booking access pbac (#24637)

2025-12-04 05:45:17 +00:00

contructEmailFromPhoneNumber.ts

feat: booking with phone number (#14461)

2024-09-11 17:56:04 -07:00

convertToNewDurationType.ts

Fixed wrong calculation of duration type on event type page. (#5557)

2022-11-17 13:38:03 +05:30

cookie.ts

feat: google ads conversion tracking (#25198)

2025-11-25 12:58:10 +00:00

crypto.test.ts

fix: handle non-deterministic AES-256-CBC decryption in crypto test (#26383)

2026-01-01 23:18:35 -03:00

crypto.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

csvUtils.ts

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

currencyConversions.ts

refactor: circular deps between app store and lib [5] (#23936)

2025-09-19 10:16:56 -03:00

dbReadResponseSchema.ts

refactor: Remove circular deps between @calcom/lib and @calcom/features [2] (#24438)

2025-10-17 06:48:08 -03:00

default-cookies.ts

refactor: cookie domain logic in defaultCookies (#22168)

2025-06-30 20:21:16 +00:00

defaultAvatarImage.ts

fix: #14769 (#14777)

2024-04-27 18:14:37 +02:00

delegationCredential.ts

refactor: circular deps between app store and lib [6] (#23971)

2025-10-09 14:02:12 +00:00

deriveAppDictKeyFromType.ts

chore: removed last web3 references (#12540)

2023-11-29 11:57:50 +00:00

emailSchema.ts

fix: Hotfix in change from @spammer.com to spammer.com (#24479)

2025-10-15 15:38:14 +01:00

entityPermissionUtils.shared.ts

refactor: prevents mixed server/clients imports (#21499)

2025-05-25 09:07:49 +00:00

env.ts

Feature: Verify login on signup with magic link. (#2122)

2022-04-21 14:32:25 -06:00

errorCodes.ts

refactor: replace TRPCError with ErrorWithCode in packages/features (#25482)

2025-12-02 08:11:17 -03:00

errors.ts

refactor: consolidate error handlers to use getServerErrorFromUnknown (#25114)

2025-11-28 09:14:06 +01:00

extract-base-email.ts

chore: Add guest email blacklist (#15255)

2024-05-30 17:13:34 +00:00

fetch-wrapper.ts

feat: Allow reschedule when max booker bookings have been reached (#21778)

2025-06-13 23:54:33 +00:00

fetchUsername.ts

fix: Correctly prefill username in case of non-org email invite in an org (#12854)

2023-12-19 02:44:48 +00:00

fetchWithTimeout.ts

fix: refactor i18n loadTranslations and set timeout to 3s (#22878)

2025-08-04 10:30:18 +01:00

findDurationType.ts

Enforces explicit type imports (#7158)

2023-02-16 15:39:57 -07:00

formatCalendarEvent.ts

fix: different calendar hosts (#24000)

2025-10-01 12:15:34 +03:00

formatPhoneNumber.ts

refactor: small improvements for cal ai (#23444)

2025-08-29 17:42:15 +05:30

formbricks.ts

feat: integrate formbricks for team disband action (#13362)

2024-02-07 04:14:26 -03:00

fromEntriesWithDuplicateKeys.ts

feat: advanced tab platform wrapper (#16941)

2024-10-10 17:09:03 +03:00

generateHashedLink.ts

feat: Multiple Private links per Event Type (#15896)

2024-10-03 00:58:54 +05:30

getAdditionalEmailHeaders.ts

fix: add sendgrid-specific header only for SendGrid smtp server (#11932)

2023-11-16 13:51:30 -03:00

getAvatarUrl.ts

chore: Remove all avatar/logo references (#14532)

2024-04-18 21:54:16 -07:00

getBooking.tsx

fix: Zod error caused by number-type responses (#23804)

2025-09-17 15:01:21 +00:00

getBrandColours.test.ts

refactor: Moving from jest to vitest (#9035)

2023-05-24 23:35:44 +00:00

getBrandColours.tsx

fix: Use constants.ts for brand colours > db DEFAULT (#13167)

2024-01-11 20:22:35 +00:00

getCalcomUrl.ts

fix: Add cal.eu to IS_CALCOM (#23111)

2025-08-18 16:04:48 +05:30

getClientErrorFromUnknown.ts

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

getIP.ts

fix: replace console logging with logger across services and features (#26127)

2025-12-23 08:24:23 +00:00

getMetadataHelpers.ts

feat: admin org list now shows all, dns check added (#10875)

2023-08-23 21:01:12 +00:00

getOrgIdFromMemberOrTeamId.ts

fix: cal ai webhook (#24368)

2025-11-05 13:31:55 +04:00

getReplyToEmail.test.ts

feat: custom reply To Email (#20771)

2025-04-23 06:44:44 -07:00

getReplyToEmail.ts

fix: replyTo includes the correct email (#21843)

2025-06-17 10:45:44 +00:00

getReplyToHeader.ts

fix: replyTo includes the correct email (#21843)

2025-06-17 10:45:44 +00:00

getSafe.ts

feat: Upgrade to Next 15 (#18834)

2025-03-20 21:30:51 -03:00

getSafeRedirectUrl.test.ts

Prevent xss in preview aand load resources from known URL (#18978)

2025-02-05 12:17:56 +05:30

getSafeRedirectUrl.ts

Prevent xss in preview aand load resources from known URL (#18978)

2025-02-05 12:17:56 +05:30

getTeamIdFromEventType.ts

feat: optimize Prisma queries by replacing findFirst with findUnique where applicable (#21826)

2025-06-17 09:52:02 +03:00

getValidRhfFieldName.test.ts

feat: normalize routing form identifier field with URL-safe format (#25128)

2025-11-18 11:24:33 +05:30

getValidRhfFieldName.ts

feat: normalize routing form identifier field with URL-safe format (#25128)

2025-11-18 11:24:33 +05:30

gtm.ts

feat: gtm push signup event (#14031)

2024-03-08 15:13:29 +00:00

hasEditPermissionForUser.ts

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

hashedLinksUtils.ts

feat: Enhance private link expiration with usage and date limits (#22304)

2025-07-24 19:54:44 +01:00

hasKeyInMetadata.ts

feature/settings-username-update (#2306)

2022-07-06 13:31:07 -06:00

http-error.ts

feat: Allow reschedule when max booker bookings have been reached (#21778)

2025-06-13 23:54:33 +00:00

i18n.ts

Fallback to next app default language (en) when user didn't specify locale. (#16425)

2024-08-30 21:37:10 +05:30

intervalTree.ts

perf: optimize filterRedundantDateRanges from O(n²) to O(n log n) (#22093)

2025-07-03 10:59:33 +01:00

invertLogoOnDark.ts

fix: logo lack of contrast (#12401)

2023-11-17 14:10:58 +00:00

isEqual.ts

feat: Attribute filter/Segment for Round Robin hosts (#17361)

2024-11-20 10:22:53 +05:30

isEventTypeColor.ts

feat: Assign colors to events (#15298)

2024-08-14 15:10:40 +02:00

isKeyInObject.ts

Adds basic global feature flags (#7459)

2023-03-24 17:59:04 -07:00

isMac.ts

Adds a fully extensible command(ctrl)+k interface for Cal (#3346)

2022-07-14 06:45:07 +00:00

isOutOfBounds.timezone.test.ts

fix: Future Limit Calculations (#15825)

2024-08-02 18:00:50 +05:30

isOutOfBounds.tsx

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

isPrismaObj.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

isProblematicTimezone.ts

Fix: Filter Timezones by cities (#7540)

2023-03-06 17:52:20 +00:00

isRecurringEvent.ts

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

isSmsCalEmail.ts

feat: booking with phone number (#14461)

2024-09-11 17:56:04 -07:00

jest.config.json

refactor: v2 event-types (#15457)

2024-06-21 10:49:12 +00:00

jsonUtils.ts

App Store (#1869)

2022-03-23 15:00:30 -07:00

logger.server.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

logger.ts

Add DI for BookingAudit (#25123)

2025-11-28 09:14:48 +00:00

markdownIt.ts

Fixes formatted description in email + sanitize html everywhere (#7928)

2023-03-28 09:40:13 +00:00

markdownToSafeHTML.ts

fix: unordered list issue (#23454)

2025-08-30 15:37:10 +00:00

markdownToSafeHTMLClient.ts

fix: unordered list issue (#23454)

2025-08-30 15:37:10 +00:00

navigateInTopWindow.ts

fix: Broken navigation after booking creation in some cases (#15664)

2024-07-08 13:56:58 +00:00

next-seo.config.ts

chore: Adds deprecated-imports-next-router (#14486)

2024-04-16 11:46:45 +01:00

notEmpty.ts

App Store (#1869)

2022-03-23 15:00:30 -07:00

objectKeys.ts

Enables strict mode in nextjs apps (#2354)

2022-04-04 20:26:14 +00:00

OgImages.tsx

feat: Introduce biome (#25664)

2025-12-29 19:41:41 -03:00

package.json

upgrade typescript (#26347)

2025-12-31 13:32:55 -03:00

parse-dates.ts

fix: recurring events with calendar connections (#12250)

2023-11-07 12:09:56 -03:00

parse-zone.ts

New Booker Component (preparations for booker atom) (#6792)

2023-04-24 16:32:30 +02:00

perf.ts

fix: replace console logging with logger across services and features (#26127)

2025-12-23 08:24:23 +00:00

piiFreeData.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

pkce.test.ts

feat: OAuth PKCE (#25313)

2025-11-26 17:02:42 +01:00

pkce.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

random.test.ts

refactor: Moving from jest to vitest (#9035)

2023-05-24 23:35:44 +00:00

random.ts

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

rateLimit.ts

fix: added conditional check for the unkey logger to reduce the number of logs (#25858)

2025-12-14 12:35:57 +00:00

recentImpersonations.ts

feat: implement recent impersonations list with localStorage storage (#23610)

2025-09-06 19:56:08 +05:30

recurringStrings.ts

fix: Recurring events set to "yearly" don't recur (#24361)

2025-11-03 16:20:15 +00:00

redactError.ts

Avoid using prisma types on client (#23566)

2025-09-04 00:58:13 +00:00

redactSensitiveData.test.ts

feat: add missing sensitive fields to redactSensitiveData (#24121)

2025-10-01 20:26:58 -03:00

redactSensitiveData.ts

feat: add missing sensitive fields to redactSensitiveData (#24121)

2025-10-01 20:26:58 -03:00

redirect.ts

refactor: Billing service (#15366)

2024-10-04 13:44:50 -07:00

retellAIFetcher.ts

feat: retell AI webhook url (#14430)

2024-04-05 22:44:57 +05:30

safeStringify.ts

fix: Show error log (#14960)

2024-05-10 08:47:57 +01:00

sanitizeCalendarObject.ts

Caldav/refactor: Mutiple Fixes and General code improvement (#8031)

2023-04-12 14:30:39 -03:00

sdk-event.ts

feat: Add framework to send all events fired for embed to Analytics Apps (#15173)

2024-05-31 16:07:09 +00:00

Sendgrid.ts

chore: update tslog from 3.2.1 to 4.9.2 (#11717)

2023-10-17 19:00:48 +00:00

sentryWrapper.ts

feat(calendar-subscription): add telemetry metrics for cache performance and webhook calls (#26501)

2026-01-07 11:27:40 +00:00

serverConfig.ts

feat: add resend email transport (#12645)

2023-12-04 15:31:55 -08:00

slugify-lenient.ts

slugify lenient (#25923)

2025-12-16 14:01:54 +00:00

slugify.test.ts

fix: typos in several package/ directories (#19495)

2025-02-24 14:44:08 +00:00

slugify.ts

refactor: Typescript fixes and updates for bumping ts version to 5.8.2 (#19690)

2025-03-05 09:17:08 -03:00

smsLockState.ts

chore: system wide ratelimit per path (#25080)

2025-11-12 22:01:59 +00:00

ssrfProtection.test.ts

fix: add URL validation for logo fields (#26522)

2026-01-08 22:03:54 +00:00

ssrfProtection.ts

fix: add URL validation for logo fields (#26522)

2026-01-08 22:03:54 +00:00

stripe-error.ts

refactor: Error code - remove circular dep between app store <-> lib (#23669)

2025-09-08 07:31:28 -03:00

stripMarkdown.ts

fix: strip markdown from meta description tag in users page (#8769)

2023-05-15 07:44:23 +00:00

telemetry.ts

chore: Remove next-collect package (#25146)

2025-11-19 13:54:26 +00:00

testEmails.ts

test: testing workflow triggers (#12823)

2023-12-21 18:57:06 +05:30

testSMS.ts

test: add unit tests for sms sending (#14737)

2024-05-02 10:42:38 -04:00

text.test.ts

refactor: Moving from jest to vitest (#9035)

2023-05-24 23:35:44 +00:00

text.ts

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

timeFormat.ts

refactor: event type builder (#19459)

2025-03-20 07:49:14 -07:00

timeShift.ts

feat: add time shift badge for recurring events with shifted local times (#25568)

2025-12-11 20:18:00 +00:00

timezone.ts

fix: timezone-dropdown (#23469)

2025-08-31 08:20:19 +00:00

timezoneConstants.ts

perf: Remove dayjs import from main constants.ts file (#19644)

2025-03-11 10:37:51 +00:00

timeZones.ts

feat(companion): new availability detail and actions pages for ios (#26424)

2026-01-04 12:48:37 -03:00

totp.ts

fix: add 2fa and email verification grace period (#10771)

2023-08-17 16:13:04 +02:00

triggerDevLogger.ts

feat: Booking EmailAndSms Notifications Tasker (#24944)

2025-11-28 14:00:04 +00:00

tsconfig.json

perf: Remove tRPC types from @calcom/lib (#24551)

2025-10-19 13:14:25 +00:00

tsconfig.test.json

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

turndownService.ts

chore: plain text plugin for Editor (#17134)

2024-11-11 20:23:12 +05:30

validateBookerLayouts.ts

feat: event settings booker layout toggle (#9082)

2023-06-06 15:31:43 +00:00

videoTokens.ts

feat: Introduce biome (#25664)

2025-12-29 19:41:41 -03:00

WebAppURL.ts

chore: Introduce a new class WebAppURL that extends URL (#14982)

2024-07-18 07:27:34 +00:00

webstorage.ts

refactor: Use sessionStorage instead of localStorage for decoy booking data (#24450)

2025-12-12 07:42:44 -03:00

weekday.test.ts

refactor: Moving from jest to vitest (#9035)

2023-05-24 23:35:44 +00:00

weekday.ts

feat(lib): add more tests to lib package (#7210)

2023-03-10 22:10:56 +00:00

weekstart.test.ts

fix: #15749 Display availability page as per weekstart setting (#15753)

2024-07-16 11:31:02 +02:00

weekstart.ts

fix: #15749 Display availability page as per weekstart setting (#15753)

2024-07-16 11:31:02 +02:00