Tweak: sanitize calendar integration URLs from markup (#6431)

src/utils/config/service-helpers.js

@@ -619,7 +619,19 @@ export function cleanServiceGroups(groups) {
           if (refreshInterval) widget.refreshInterval = refreshInterval;
         }
         if (type === "calendar") {
-          if (integrations) widget.integrations = integrations;
+          if (integrations) {
+            if (Array.isArray(integrations)) {
+              widget.integrations = integrations.map((integration) => {
+                if (!integration || typeof integration !== "object") {
+                  return integration;
+                }
+                const { url, ...integrationWithoutUrl } = integration;
+                return integrationWithoutUrl;
+              });
+            } else {
+              widget.integrations = integrations;
+            }
+          }
           if (firstDayInWeek) widget.firstDayInWeek = firstDayInWeek;
           if (view) widget.view = view;
           if (maxEvents) widget.maxEvents = maxEvents;

src/utils/config/service-helpers.test.js

@@ -369,6 +369,47 @@ describe("utils/config/service-helpers", () => {
     expect(widgets.find((w) => w.type === "lubelogger")).toEqual(expect.objectContaining({ vehicleID: 12 }));
   });
 
+  it("cleanServiceGroups removes calendar integration urls from frontend widget payload", async () => {
+    const mod = await import("./service-helpers");
+    const { cleanServiceGroups } = mod;
+
+    const rawGroups = [
+      {
+        name: "Core",
+        services: [
+          {
+            name: "Calendar",
+            weight: 100,
+            widgets: [
+              {
+                type: "calendar",
+                integrations: [
+                  {
+                    type: "ical",
+                    name: "EPL Fixtures",
+                    url: "https://calendar.google.com/calendar/ical/example/public/basic.ics",
+                    color: "purple",
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+        groups: [],
+      },
+    ];
+
+    const cleaned = cleanServiceGroups(rawGroups);
+    const calendarWidget = cleaned[0].services[0].widgets[0];
+    expect(calendarWidget.integrations).toEqual([
+      {
+        type: "ical",
+        name: "EPL Fixtures",
+        color: "purple",
+      },
+    ]);
+  });
+
   it("findGroupByName deep-searches and annotates parent", async () => {
     const mod = await import("./service-helpers");
     const { findGroupByName } = mod;