auto: 2026-06-18_06:00 changes

1 files changed, 5 insertions, 2 deletions

diff --git a/modules/ext/critical-ext-bundle.js b/modules/ext/critical-ext-bundle.js
index 9def12d..4242ebf 100644
--- a/modules/ext/critical-ext-bundle.js
+++ b/modules/ext/critical-ext-bundle.js
@@ -894,8 +894,11 @@ class FileManagerModule {
             html = html.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>');
             // italic
             html = html.replace(/\*(.+?)\*/g, '<em>$1</em>');
-            // links
-            html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" target="_blank" style="color:var(--info-color)">$1</a>');
+            // links — v4.5.67: sanitize URL to prevent javascript: scheme injection
+            html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (match, text, url) => {
+                const safeUrl = /^(https?:\/\/|mailto:|\/|#)/.test(url) ? url : '#';
+                return `<a href="${safeUrl}" target="_blank" style="color:var(--info-color)">${text}</a>`;
+            });
             // horizontal rules
             html = html.replace(/^---$/gm, '<hr style="border-color:var(--border-color);margin:8px 0">');
             // unordered lists