fix(email): validate and escape unwrapped SafeLinks URLs before rendering

2026-11-07 08:31:01 +01:00 · 2026-07-13 10:07:58 +05:30
parent 5ef0b40dea
commit 8dcd936873
2 changed files with 54 additions and 1 deletions
@@ -331,7 +331,16 @@ export function sanitizeEmailHtml(html: string): string {
    (match, encodedUrl) => {
      try {
        const decodedUrl = decodeURIComponent(encodedUrl);
-        return `href="${decodedUrl}"`;
+        let parsed: URL;
+        try {
+          parsed = new URL(decodedUrl);
+        } catch {
+          return match;
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+          return match;
+        }
+        return `href="${escapeHtml(decodedUrl)}"`;
      } catch {
        return match;
      }