From 633364d402a883508e54c0ebaba781c4c7b38274 Mon Sep 17 00:00:00 2001 From: Sean McNellis <2292260+seanmcne@users.noreply.github.com> Date: Tue, 6 Jan 2026 12:51:43 -0600 Subject: [PATCH 1/2] Code Enhancement from code scanning: Improved URL substring sanitization (#150) * Potential fix for Incomplete URL substring sanitization question Only applies to detecting if it's onprem or online which leads to the presentation of a ribbon letting the user know it's onprem so it's very low risk however, using something that's more modern would be better. * Update logic for online/onprem root domain detection --- .../OrgDbOrgSettings/orgDBOrgSettings.html | 28 +++++++++++++++++-- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/mspfedyn_/OrgDbOrgSettings/Solution/WebResources/mspfedyn_/OrgDbOrgSettings/orgDBOrgSettings.html b/mspfedyn_/OrgDbOrgSettings/Solution/WebResources/mspfedyn_/OrgDbOrgSettings/orgDBOrgSettings.html index 0a3acb1..a69c6ab 100644 --- a/mspfedyn_/OrgDbOrgSettings/Solution/WebResources/mspfedyn_/OrgDbOrgSettings/orgDBOrgSettings.html +++ b/mspfedyn_/OrgDbOrgSettings/Solution/WebResources/mspfedyn_/OrgDbOrgSettings/orgDBOrgSettings.html @@ -1302,9 +1302,30 @@ - then paint the grid? */ //alert user of other settings if OnPrem - var urlFunction = Xrm.Page.context.getClientUrl() || Xrm.Page.context.getServerUrl(); - if (!(urlFunction.toLowerCase().indexOf(".dynamics.com") !== -1)) { - updateBanner("Your environment is OnPremise, these settings may need to be checked against the ConfigDB(PowerShell) and Registry settings.", false, "onpremmsg"); + var urlFunction = Xrm.Page.context.getClientUrl() || Xrm.Page.context.getServerUrl(); + var isOnline = false; + + try { + var host = new URL(urlFunction).hostname.toLowerCase(); + + // Extract the registrable domain (last two labels) + var parts = host.split("."); + var domain = parts.slice(-2).join("."); + + // Allowed root domains for Dynamics 365 Online + var onlineRootDomains = ["dynamics.com"]; + + isOnline = onlineRootDomains.includes(domain); + } catch (e) { + isOnline = false; + } + + if (!isOnline) { + updateBanner( + "Your environment is OnPremise, these settings may need to be checked against the ConfigDB(PowerShell) and Registry settings.", + false, + "onpremmsg" + ); } window.setTimeout(function () { var height = parent.window.outerHeight || parent.document.documentElement.clientHeight; @@ -1663,3 +1684,4 @@