From 44ddfa510eba751511fea7f1e4b8907f4dbd1615 Mon Sep 17 00:00:00 2001 From: Maurice Date: Sun, 23 Aug 2026 11:35:10 +0200 Subject: [PATCH] fix(client): only give a scheme to something that looks like a host safeExternalHref prefixed https:// to anything without a scheme, which turns a note that reads "call the hotel" into a link to a host that does not exist. A dot and no whitespace is what separates www.hotel.com from free text. --- client/src/utils/safeUrl.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/client/src/utils/safeUrl.ts b/client/src/utils/safeUrl.ts index ba87d71b6..b6a21bef8 100644 --- a/client/src/utils/safeUrl.ts +++ b/client/src/utils/safeUrl.ts @@ -42,5 +42,9 @@ export function safeExternalHref(value: string | null | undefined): string | nul if (/^https?:\/\//i.test(collapsed)) return trimmed // Any other scheme, executing or merely unexpected, stays unlinked. if (/^[a-z][a-z0-9+.-]*:/i.test(collapsed)) return null - return `https://${trimmed}` + // A bare host gets https://, the way an address bar would take it. Free text + // does not: "www.hotel.com" is a site somebody meant to link, "call the hotel" + // is a note, and turning the second into a link is worse than leaving it flat. + if (/^[^\s/?#]+\.[^\s/?#]+/.test(trimmed)) return `https://${trimmed}` + return null }