Repository navigation
[OSS→OHE parity] Open the VS Code URL safely from OHE's conversation card #1149
Description
Gap
- OSS change: OpenHands/OpenHands#19229 — fix(conversation-card): open VS Code URL with noopener and http(s) only (unreleased, expected in v1.35.0)
- OSS paths:
src/components/features/conversation-panel/conversation-card/conversation-card.tsx,src/utils/vscode-url-helper.ts - Gap key:
gap:canvas/v1.32.0..main/conversation-card-vscode-url#19229· blocker typemissing-integration - Evidence: static inspection of enterprise
mainat41cc71a18. Needs live validation: no.
What OHE is missing
The VS Code URL comes from the backend and is opened in a new tab. OSS now rejects any URL that is not http or https, and opens it with noopener. OHE has its own copy of both files. conversation-card.tsx calls window.open(transformedUrl, "_blank") with no noopener. vscode-url-helper.ts returns the original URL on a parse error and has no protocol allow-list. The bundle bump does not change these files.
Where it belongs in OHE
Scope: not a setting. This is a security fix in two existing files. No scope or flag decision is needed.
Target files:
frontend/src/utils/vscode-url-helper.ts— reject unparsable and non-http(s) URLs (returnnull)frontend/src/components/features/conversation-panel/conversation-card/conversation-card.tsx— open with"noopener,noreferrer"frontend/__tests__/utils/vscode-url-helper.test.ts— update the cases for the new behavior
OHE principles that apply
- P10 Change the right frontend: this is the legacy OHE conversation card. The bundle bump does not reach it.
Acceptance
- A
javascript:,data:or unparsable VS Code URL is not opened. - An http(s) URL opens in a new tab with
noopenerandnoreferrer. The localhost rewrite still works. - Unit tests cover the allow-list and the rejected cases.
Dependencies
None. The OSS PR is not in a tagged release yet; this OHE change does not need the pin bump.
Duplicate check
Searched OpenHands/enterprise issues and PRs for 19229, "vscode-url-helper" and "noopener". No issue or open PR covers it. The one hit, closed enterprise#128, is about conversation mutation caches.
This issue was created by an AI agent (OpenHands) via the OHE OSS gap discovery automation.
Activity
juanmichelini commentedon Nov 4, 2026
@OpenHands please fix this. once you are done please label the PR with verify-this label
openhands-ai commentedon Nov 4, 2026
I'm on it! juanmichelini can track my progress at all-hands.dev
openhands-ai commentedon Nov 4, 2026
Fixed issue #1149 — opened the VS Code URL safely from OHE's conversation card, mirroring OSS PR OpenHands/OpenHands#19229.
Changes (3 files)
frontend/src/utils/vscode-url-helper.ts— added anhttp:/https:protocol allow-list and now returnsnullfor URLs that fail to parse or use a disallowed scheme (javascript:,data:,file:, …). Thelocalhost → current hostnamerewrite is preserved.frontend/src/components/features/conversation-panel/conversation-card/conversation-card.tsx—window.open(transformedUrl, "_blank")→window.open(transformedUrl, "_blank", "noopener,noreferrer").frontend/__tests__/utils/vscode-url-helper.test.ts— updated the unparsable case to expectnulland addedit.eachcases forjavascript:,data:, andfile:URLs.Verification
npx vitest run __tests__/utils/vscode-url-helper.test.ts→ 9 passed.// eslint-disable-next-line no-script-urlon thejavascript:test literal, since OHE's airbnb eslint config flags it while OSS's config does not.)All acceptance criteria from the issue are met: non-http(s)/unparsable URLs are not opened; http(s) URLs open in a new tab with
noopener/noreferrer; the localhost rewrite still works; unit tests cover the allow-list and rejected cases.PR
Opened #1165 (base
main, branchopenhands/fix-vscode-url-safe-open) and applied the verify-this label as requested. The PR description follows the repo template and states it fixes #1149.