k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-18 21:16:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(client): only give a scheme to something that looks like a host

Browse Source 
safeExternalHref prefixed https:// to anything without a scheme, which turns
a note that reads "call the hotel" into a link to a host that does not exist.
A dot and no whitespace is what separates www.hotel.com from free text.
This commit is contained in:
Maurice
2026-08-23 11:35:10 +02:00
committed by Maurice
parent 7c6a17c020
commit 44ddfa510e
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/utils/safeUrl.ts
+5 -1
View File
@@ -42,5 +42,9 @@ export function safeExternalHref(value: string | null | undefined): string | nul
if (/^https?:\/\//i.test(collapsed)) return trimmed
// Any other scheme, executing or merely unexpected, stays unlinked.
if (/^[a-z][a-z0-9+.-]*:/i.test(collapsed)) return null
return `https://${trimmed}`
// A bare host gets https://, the way an address bar would take it. Free text
// does not: "www.hotel.com" is a site somebody meant to link, "call the hotel"
// is a note, and turning the second into a link is worse than leaving it flat.
if (/^[^\s/?#]+\.[^\s/?#]+/.test(trimmed)) return `https://${trimmed}`
return null
}