From ca67ba2e492f7eb2561bcbf10a7942a6bdb4cbc1 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Mon, 16 Mar 2026 16:02:50 -0700
Subject: [PATCH] Tweak: sanitize calendar integration URLs from markup (#6431)

---
 src/utils/config/service-helpers.js      | 14 +++++++-
 src/utils/config/service-helpers.test.js | 41 ++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/src/utils/config/service-helpers.js b/src/utils/config/service-helpers.js
index 52f8dcb05..f9651af5d 100644
--- a/src/utils/config/service-helpers.js
+++ b/src/utils/config/service-helpers.js
@@ -619,7 +619,19 @@ export function cleanServiceGroups(groups) {
           if (refreshInterval) widget.refreshInterval = refreshInterval;
         }
         if (type === "calendar") {
-          if (integrations) widget.integrations = integrations;
+          if (integrations) {
+            if (Array.isArray(integrations)) {
+              widget.integrations = integrations.map((integration) => {
+                if (!integration || typeof integration !== "object") {
+                  return integration;
+                }
+                const { url, ...integrationWithoutUrl } = integration;
+                return integrationWithoutUrl;
+              });
+            } else {
+              widget.integrations = integrations;
+            }
+          }
           if (firstDayInWeek) widget.firstDayInWeek = firstDayInWeek;
           if (view) widget.view = view;
           if (maxEvents) widget.maxEvents = maxEvents;
diff --git a/src/utils/config/service-helpers.test.js b/src/utils/config/service-helpers.test.js
index 0c6cf44ab..92145b13b 100644
--- a/src/utils/config/service-helpers.test.js
+++ b/src/utils/config/service-helpers.test.js
@@ -369,6 +369,47 @@ describe("utils/config/service-helpers", () => {
     expect(widgets.find((w) => w.type === "lubelogger")).toEqual(expect.objectContaining({ vehicleID: 12 }));
   });
 
+  it("cleanServiceGroups removes calendar integration urls from frontend widget payload", async () => {
+    const mod = await import("./service-helpers");
+    const { cleanServiceGroups } = mod;
+
+    const rawGroups = [
+      {
+        name: "Core",
+        services: [
+          {
+            name: "Calendar",
+            weight: 100,
+            widgets: [
+              {
+                type: "calendar",
+                integrations: [
+                  {
+                    type: "ical",
+                    name: "EPL Fixtures",
+                    url: "https://calendar.google.com/calendar/ical/example/public/basic.ics",
+                    color: "purple",
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+        groups: [],
+      },
+    ];
+
+    const cleaned = cleanServiceGroups(rawGroups);
+    const calendarWidget = cleaned[0].services[0].widgets[0];
+    expect(calendarWidget.integrations).toEqual([
+      {
+        type: "ical",
+        name: "EPL Fixtures",
+        color: "purple",
+      },
+    ]);
+  });
+
   it("findGroupByName deep-searches and annotates parent", async () => {
     const mod = await import("./service-helpers");
     const { findGroupByName } = mod;