Addressing some comments

src/app.js

@@ -12,6 +12,7 @@ var router = require('./router');
 var template = require('./menutemplate');
 var webUtil = require('./utils/WebUtil');
 var urlUtil = require ('./utils/URLUtil');
+var util = require('./Util');
 var app = remote.require('app');
 var request = require('request');
 
@@ -63,7 +64,12 @@ ipc.on('application:open-url', opts => {
     if (err || response.statusCode !== 200) {
       return;
     }
+
     var flags = JSON.parse(body);
+    if (!flags) {
+      return;
+    }
+
     urlUtil.openUrl(opts.url, flags, app.getVersion());
   });
 });

src/utils/URLUtil-test.js

@@ -15,7 +15,7 @@ describe('URLUtil', function () {
     expect(urlUtil.openUrl()).toBe(false);
   });
 
-  it('does nothing if the flags are undefined', () => {
+  it('does nothing if the flags object is undefined', () => {
     util.compareVersions.mockReturnValue(1);
     util.isOfficialRepo.mockReturnValue(true);
     expect(urlUtil.openUrl('docker://repository/run/redis')).toBe(false);
@@ -27,12 +27,24 @@ describe('URLUtil', function () {
     expect(urlUtil.openUrl('docker://repository/run/redis', {dockerURLEnabledVersion: undefined})).toBe(false);
   });
 
-  it('does nothing if the url enabled flag is less than the flag version', () => {
+  it('does nothing if the url enabled flag version is higher than the app version', () => {
     util.compareVersions.mockReturnValue(-1);
     util.isOfficialRepo.mockReturnValue(true);
     expect(urlUtil.openUrl('docker://repository/run/redis', {dockerURLEnabledVersion: '0.5.19'}, '0.5.18')).toBe(false);
   });
 
+  it('does nothing if the type is not in the whitelist', () => {
+    util.compareVersions.mockReturnValue(1);
+    util.isOfficialRepo.mockReturnValue(true);
+    expect(urlUtil.openUrl('docker://badtype/run/redis', {dockerURLEnabledVersion: '0.5.19'}, '0.5.18')).toBe(false);
+  });
+
+  it('does nothing if the method is not in the whitelist', () => {
+    util.compareVersions.mockReturnValue(1);
+    util.isOfficialRepo.mockReturnValue(true);
+    expect(urlUtil.openUrl('docker://repository/badmethod/redis', {dockerURLEnabledVersion: '0.5.19'}, '0.5.18')).toBe(false);
+  });
+
   it('does nothing if protocol is not docker:', () => {
     util.compareVersions.mockReturnValue(1);
     util.isOfficialRepo.mockReturnValue(true);

src/utils/URLUtil.js

@@ -3,8 +3,10 @@ var parseUri = require('parseUri');
 var containerStore = require('../stores/ContainerStore');
 
 module.exports = {
+  TYPE_WHITELIST: ['repository'],
+  METHOD_WHITELIST: ['run'],
   openUrl: function (url, flags, appVersion) {
-    if (!url || !flags || !flags.dockerURLEnabledVersion) {
+    if (!url || !flags || !flags.dockerURLEnabledVersion || !appVersion) {
       return false;
     }
 
@@ -22,15 +24,28 @@ module.exports = {
     // Get the type of object we're operating on, e.g. 'repository'
     var type = parser.host;
 
+    if (this.TYPE_WHITELIST.indexOf(type) === -1) {
+      return false;
+    }
+
     // Separate the path into [run', 'redis']
     var tokens = parser.path.replace('/', '').split('/');
 
     // Get the method trying to be executed, e.g. 'run'
     var method = tokens[0];
 
+    if (this.METHOD_WHITELIST.indexOf(method) === -1) {
+      return false;
+    }
+
     // Get the repository namespace and repo name, e.g. 'redis' or 'myusername/myrepo'
     var repo = tokens.slice(1).join('/');
 
+    // Only accept official repos for now (one component)
+    if (tokens > 1) {
+      return false;
+    }
+
     // Only accept official repos for now
     if (!util.isOfficialRepo(repo)) {
       return false;
@@ -40,5 +55,6 @@ module.exports = {
       containerStore.setPending(repo, 'latest');
       return true;
     }
+    return false;
   }
 };

src/utils/Util.js

@@ -56,6 +56,11 @@ module.exports = {
     if (!name || !name.length) {
       return false;
     }
+
+    // An official repo is alphanumeric characters separated by dashes or
+    // underscores.
+    // Examples: myrepo, my-docker-repo, my_docker_repo
+    // Non-exapmles: mynamespace/myrepo, my%!repo
     var repoRegexp = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
     return repoRegexp.test(name);
   },