From 3fbbae3ab0a7690eb1fac6604bbdf0e2a43377b7 Mon Sep 17 00:00:00 2001
From: Valentin Serra <valentin.serra@camunda.com>
Date: Tue, 16 Jan 2024 07:23:59 +0100
Subject: [PATCH] fix: do not validate iframe source when defined by
 expressions

Closes #974
---
 .../entries/IFrameUrlEntry.js                 |  2 +-
 .../properties-panel/PropertiesPanel.spec.js  | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/packages/form-js-editor/src/features/properties-panel/entries/IFrameUrlEntry.js b/packages/form-js-editor/src/features/properties-panel/entries/IFrameUrlEntry.js
index 01014a67c..6d4ec119a 100644
--- a/packages/form-js-editor/src/features/properties-panel/entries/IFrameUrlEntry.js
+++ b/packages/form-js-editor/src/features/properties-panel/entries/IFrameUrlEntry.js
@@ -48,7 +48,7 @@ function Url(props) {
   };
 
   const validate = (value) => {
-    if (!value) {
+    if (!value || value.startsWith('=')) {
       return;
     }
 
diff --git a/packages/form-js-editor/test/spec/features/properties-panel/PropertiesPanel.spec.js b/packages/form-js-editor/test/spec/features/properties-panel/PropertiesPanel.spec.js
index ef15330ab..82a6e3031 100644
--- a/packages/form-js-editor/test/spec/features/properties-panel/PropertiesPanel.spec.js
+++ b/packages/form-js-editor/test/spec/features/properties-panel/PropertiesPanel.spec.js
@@ -3710,6 +3710,31 @@ describe('properties panel', function() {
 
       });
 
+
+      it('should NOT show error for expressions', async function() {
+
+        // given
+        const field = iframeSchema.components.find(({ url }) => url === 'https://bpmn.io/');
+
+        bootstrapPropertiesPanel({
+          container,
+          field
+        });
+
+        const feelers = findFeelers('url', container);
+        expect(feelers.textContent).to.equal('https://bpmn.io/');
+
+        const input = feelers.querySelector('div[contenteditable="true"]');
+
+        // when
+        await setEditorValue(input, '=url');
+
+        // then
+        const error = screen.queryByText('For security reasons the URL must start with "https".');
+
+        expect(error).not.to.exist;
+      });
+
     });