chore: keep security suggestions regarding regex

Author: maheshkutty

packages/analytics-js-integrations/__tests__/integrations/GoogleAds/browser.test.js

@@ -92,7 +92,7 @@ describe('GoogleAds init tests', () => {
 
   test('uses custom sdkBaseUrl when provided', () => {
     googleAds = new GoogleAds(
-      { conversionID: mockConversionId, sdkBaseUrl: 'https://custom-gtm.example.com' },
+      { conversionID: mockConversionId, sdkBaseUrl: 'https://custom-gtm.example.com/gtag/js' },
       {},
       destinationInfo,
     );
@@ -106,7 +106,7 @@ describe('GoogleAds init tests', () => {
 
   test('normalizes trailing slash in sdkBaseUrl', () => {
     googleAds = new GoogleAds(
-      { conversionID: mockConversionId, sdkBaseUrl: 'https://custom-gtm.example.com///' },
+      { conversionID: mockConversionId, sdkBaseUrl: 'https://custom-gtm.example.com/gtag/js///' },
       {},
       destinationInfo,
     );

packages/analytics-js-integrations/__tests__/utils/utils.test.js

@@ -373,3 +373,66 @@ describe('getValueOrDefault Tests', () => {
     expect(utils.getValueOrDefault({}, false)).toBe(false);
   });
 });
+
+describe('isValidURL Tests', () => {
+  test('returns false for non-string inputs', () => {
+    expect(utils.isValidURL(undefined)).toBe(false);
+    expect(utils.isValidURL(null)).toBe(false);
+    expect(utils.isValidURL(123)).toBe(false);
+    expect(utils.isValidURL({})).toBe(false);
+    expect(utils.isValidURL([])).toBe(false);
+  });
+
+  test('returns false for empty or blank strings', () => {
+    expect(utils.isValidURL('')).toBe(false);
+    expect(utils.isValidURL('   ')).toBe(false);
+  });
+
+  test('returns true for valid http and https URLs', () => {
+    expect(utils.isValidURL('http://example.com')).toBe(true);
+    expect(utils.isValidURL('https://example.com')).toBe(true);
+    expect(utils.isValidURL('https://www.googletagmanager.com/gtag/js')).toBe(true);
+    expect(utils.isValidURL('https://custom-gtm.example.com/gtag/js?id=AW-123')).toBe(true);
+    expect(utils.isValidURL('http://localhost:8080')).toBe(true);
+    expect(utils.isValidURL('https://192.168.0.1:3000/path')).toBe(true);
+  });
+
+  test('returns false for URLs with unsupported or missing protocol', () => {
+    expect(utils.isValidURL('ftp://example.com')).toBe(false);
+    expect(utils.isValidURL('ws://example.com')).toBe(false);
+    expect(utils.isValidURL('example.com')).toBe(false);
+    expect(utils.isValidURL('www.example.com')).toBe(false);
+    expect(utils.isValidURL('//example.com')).toBe(false);
+  });
+
+  test('returns false for malformed URLs', () => {
+    expect(utils.isValidURL('not-a-valid-url')).toBe(false);
+    expect(utils.isValidURL('http://')).toBe(false);
+    expect(utils.isValidURL('https://')).toBe(false);
+  });
+
+  describe('fallback path when globalThis.URL is unavailable', () => {
+    let originalURL;
+
+    beforeEach(() => {
+      originalURL = globalThis.URL;
+      // Force the regex fallback branch
+      globalThis.URL = undefined;
+    });
+
+    afterEach(() => {
+      globalThis.URL = originalURL;
+    });
+
+    test('returns true for valid http/https URLs via regex fallback', () => {
+      expect(utils.isValidURL('http://example.com')).toBe(true);
+      expect(utils.isValidURL('https://www.googletagmanager.com/gtag/js?id=AW-123')).toBe(true);
+    });
+
+    test('returns false for invalid URLs via regex fallback', () => {
+      expect(utils.isValidURL('not-a-valid-url')).toBe(false);
+      expect(utils.isValidURL('ftp://example.com')).toBe(false);
+      expect(utils.isValidURL('http://')).toBe(false);
+    });
+  });
+});

packages/analytics-js-integrations/src/integrations/GoogleAds/browser.js

@@ -53,7 +53,7 @@ class GoogleAds {
     if (sanitizedSdkBaseUrl && !isValidURL(sanitizedSdkBaseUrl)) {
       throw new Error(`Invalid sdkBaseUrl: "${sanitizedSdkBaseUrl}"`);
     }
-    this.sdkBaseUrl = sanitizedSdkBaseUrl || 'https://www.googletagmanager.com';
+    this.sdkBaseUrl = sanitizedSdkBaseUrl || 'https://www.googletagmanager.com/gtag/js';
     this.name = NAME;
     ({
       shouldApplyDeviceModeTransformation: this.shouldApplyDeviceModeTransformation,
@@ -63,7 +63,7 @@ class GoogleAds {
   }
 
   init() {
-    const sourceUrl = `${this.sdkBaseUrl}/gtag/js?id=${this.conversionId}`;
+    const sourceUrl = `${this.sdkBaseUrl}?id=${this.conversionId}`;
     loadNativeSdk(sourceUrl);
 
     // Additional Settings

packages/analytics-js-integrations/src/utils/utils.js

@@ -35,27 +35,9 @@ function removeTrailingSlashes(inURL) {
   return inURL?.endsWith('/') ? inURL.replace(/\/+$/, '') : inURL;
 }
 
-// NOTE: URL_PATTERN and isValidURL below are duplicated from
-// `@rudderstack/analytics-js-common` (src/constants/urls.ts and src/utilities/url.ts).
-// We intentionally avoid depending on analytics-js-common here so that
-// non-functional changes (e.g. type-only edits) in common do not force a
-// rebuild + release of analytics-js-integrations. Tracked under SDK-4878 —
-// once a frozen-API shared utilities package exists, switch this module to
-// consume it and delete the duplicate. Keep the two implementations in sync
-// until then.
-const URL_PATTERN = new RegExp(
-  '^(https?:\\/\\/)' + // protocol
-    '(' +
-    '((([a-zA-Z\\d]([a-zA-Z\\d-]*[a-zA-Z\\d])*)\\.)+[a-zA-Z]{2,}|' + // domain name
-    'localhost|' + // localhost
-    '((25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9]?)\\.){3}' + // OR IP (v4) address first 3 octets
-    '(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9]?))' + // last octet of IP address
-    ')' +
-    '(\\:\\d+)?' + // port
-    '(\\/[-a-zA-Z\\d%_.~+]*)*' + // path
-    '(\\?[;&a-zA-Z\\d%_.~+=-]*)?' + // query string
-    '(\\#[-a-zA-Z\\d_]*)?$', // fragment locator
-);
+// Keep fallback validation simple and linear-time for environments without URL support.
+// This checks basic URL shape only; full validation should use the built-in URL parser.
+const URL_PATTERN = /^https?:\/\/[^\s#$./?].\S*$/i;
 
 /**
  * Checks if provided url is valid or not
@@ -68,12 +50,16 @@ function isValidURL(url) {
   }
 
   try {
-    // If URL is supported by the browser, we can use it to validate the URL
-    // Otherwise, we can at least check if the URL matches the pattern
+    // Prefer built-in URL parsing where available (linear and standards-based).
     if (typeof globalThis.URL === 'function') {
       // eslint-disable-next-line no-new
-      new URL(url);
+      const parsedURL = new URL(url);
+      return (
+        (parsedURL.protocol === 'http:' || parsedURL.protocol === 'https:') &&
+        parsedURL.hostname.length > 0
+      );
     }
+    // Fallback for environments without URL support.
     return URL_PATTERN.test(url);
   } catch (e) {
     return false;