fix: disable open link button for unsafe link

luka-nextcloud · luka-nextcloud · commit 6ecc74d89963 · 2026-06-01T10:45:51.000+02:00
Signed-off-by: Luka Trovic &lt;luka@nextcloud.com&gt;
diff --git a/src/components/Link/LinkBubbleView.vue b/src/components/Link/LinkBubbleView.vue
@@ -12,8 +12,9 @@
 			</div>
 			<!-- open link -->
 			<NcButton
-				:title="t('text', 'Open link')"
-				:aria-label="t('text', 'Open link')"
+				:disabled="!isSafeHref"
+				:title="openLinkTitle"
+				:aria-label="openLinkTitle"
 				variant="tertiary"
 				@click="openLink(href)">
 				<template #icon>
@@ -98,6 +99,7 @@ import OpenInNewIcon from 'vue-material-design-icons/OpenInNew.vue'
 import PencilOutlineIcon from 'vue-material-design-icons/PencilOutline.vue'
 
 import { useOpenLinkHandler } from '../../composables/useOpenLinkHandler.ts'
+import { PROTOCOLS_TO_LINK_TO } from '../../marks/Link.ts'
 import PreviewOptions from '../Editor/PreviewOptions.vue'
 
 const PROTOCOLS_WITH_PREVIEW = ['http:', 'https:']
@@ -170,6 +172,27 @@ export default {
 				return false
 			}
 		},
+
+		isSafeHref() {
+			try {
+				const url = new URL(this.href, window.location)
+				return !!this.href && PROTOCOLS_TO_LINK_TO.includes(url.protocol)
+			} catch {
+				return false
+			}
+		},
+
+		openLinkTitle() {
+			if (this.isSafeHref) {
+				return t('text', 'Open link')
+			}
+
+			if (!this.href) {
+				return t('text', 'No link available to open')
+			}
+
+			return t('text', 'Cannot open links with unsafe protocols')
+		},
 	},
 
 	watch: {
diff --git a/src/marks/Link.ts b/src/marks/Link.ts
@@ -13,7 +13,7 @@ import { defaultMarkdownSerializer } from 'prosemirror-markdown'
 import { domHref, parseHref } from '../helpers/links.js'
 import { linkClicking } from '../plugins/links'
 
-const PROTOCOLS_TO_LINK_TO = ['http:', 'https:', 'mailto:', 'tel:']
+export const PROTOCOLS_TO_LINK_TO = ['http:', 'https:', 'mailto:', 'tel:']
 
 const extractHrefFromMatch = (match: ExtendedRegExpMatchArray) => {
 	return { href: match.groups?.href }
