Skip to content

fix: disable open link button for unsafe link #8651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
luka-nextcloud wants to merge 1 commit into
base: main
Choose a base branch
from
+25 −2
Open

fix: disable open link button for unsafe link #8651

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 25 additions & 2 deletions src/components/Link/LinkBubbleView.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,9 @@
</div>
<!-- open link -->
<NcButton
:title="t('text', 'Open link')"
:aria-label="t('text', 'Open link')"
:disabled="!isSafeHref"
:title="openLinkTitle"
:aria-label="openLinkTitle"
variant="tertiary"
@click="openLink(href)">
<template #icon>
Expand Down Expand Up @@ -101,6 +102,7 @@ import { useOpenLinkHandler } from '../../composables/useOpenLinkHandler.ts'
import PreviewOptions from '../Editor/PreviewOptions.vue'

const PROTOCOLS_WITH_PREVIEW = ['http:', 'https:']
const SAFE_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:']
Copy link
Copy Markdown
Member

@mejo- mejo- May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We already have PROTOCOLS_TO_LINK_TO = ['http:', 'https:', 'mailto:', 'tel:'] in src/marks/Link.ts, how about exporting the variable there and reusing it here?


export default {
name: 'LinkBubbleView',
Expand Down Expand Up @@ -170,6 +172,27 @@ export default {
return false
}
},

isSafeHref() {
try {
const url = new URL(this.href, window.location)
return !!this.href && SAFE_PROTOCOLS.includes(url.protocol)
} catch {
return false
}
},

openLinkTitle() {
if (this.isSafeHref) {
return t('text', 'Open link')
}

if (!this.href) {
return t('text', 'No link available to open')
}

return t('text', 'Cannot open links with unsafe protocols')
},
},

watch: {
Expand Down
Loading