From 642aec3bab84322161e1ddfe81444ee20fac5304 Mon Sep 17 00:00:00 2001
From: Luka Trovic <luka@nextcloud.com>
Date: Tue, 26 May 2026 15:50:49 +0200
Subject: [PATCH] fix: disable open link button for unsafe link

Signed-off-by: Luka Trovic <luka@nextcloud.com>
---
 src/components/Link/LinkBubbleView.vue | 27 ++++++++++++++++++++++++--
 src/marks/Link.js                      |  2 +-
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/components/Link/LinkBubbleView.vue b/src/components/Link/LinkBubbleView.vue
index cc8a1e66cf7..4f0dbeb1546 100644
--- a/src/components/Link/LinkBubbleView.vue
+++ b/src/components/Link/LinkBubbleView.vue
@@ -12,8 +12,9 @@
 			</div>
 			<!-- open link -->
 			<NcButton
-				:title="t('text', 'Open link')"
-				:aria-label="t('text', 'Open link')"
+				:disabled="!isSafeHref"
+				:title="openLinkTitle"
+				:aria-label="openLinkTitle"
 				variant="tertiary"
 				@click="openLink(href)">
 				<template #icon>
@@ -98,6 +99,7 @@ import OpenInNewIcon from 'vue-material-design-icons/OpenInNew.vue'
 import PencilOutlineIcon from 'vue-material-design-icons/PencilOutline.vue'
 
 import { useOpenLinkHandler } from '../../composables/useOpenLinkHandler.ts'
+import { PROTOCOLS_TO_LINK_TO } from '../../marks/Link.js'
 import PreviewOptions from '../Editor/PreviewOptions.vue'
 
 const PROTOCOLS_WITH_PREVIEW = ['http:', 'https:']
@@ -170,6 +172,27 @@ export default {
 				return false
 			}
 		},
+
+		isSafeHref() {
+			try {
+				const url = new URL(this.href, window.location)
+				return !!this.href && PROTOCOLS_TO_LINK_TO.includes(url.protocol)
+			} catch {
+				return false
+			}
+		},
+
+		openLinkTitle() {
+			if (this.isSafeHref) {
+				return t('text', 'Open link')
+			}
+
+			if (!this.href) {
+				return t('text', 'No link available to open')
+			}
+
+			return t('text', 'Cannot open links with unsafe protocols')
+		},
 	},
 
 	watch: {
diff --git a/src/marks/Link.js b/src/marks/Link.js
index b95983f6fc3..ce383493bcb 100644
--- a/src/marks/Link.js
+++ b/src/marks/Link.js
@@ -9,7 +9,7 @@ import { defaultMarkdownSerializer } from 'prosemirror-markdown'
 import { linkClicking } from '../plugins/links.ts'
 import { domHref, parseHref } from './../helpers/links.js'
 
-const PROTOCOLS_TO_LINK_TO = ['http:', 'https:', 'mailto:', 'tel:']
+export const PROTOCOLS_TO_LINK_TO = ['http:', 'https:', 'mailto:', 'tel:']
 
 const extractHrefFromMatch = (match) => {
 	return { href: match.groups.href }