From fba6df22dae297c89fa0df065628dddded66c69c Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Thu, 18 Jun 2026 06:00:40 +0200
Subject: auto: 2026-06-18_06:00 changes

---
 modules/ext/filemgr.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'modules/ext/filemgr.js')

diff --git a/modules/ext/filemgr.js b/modules/ext/filemgr.js
index 3cd2687..141bee4 100644
--- a/modules/ext/filemgr.js
+++ b/modules/ext/filemgr.js
@@ -93,8 +93,11 @@ class FileManagerModule {
             html = html.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>');
             // italic
             html = html.replace(/\*(.+?)\*/g, '<em>$1</em>');
-            // links
-            html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" target="_blank" style="color:var(--info-color)">$1</a>');
+            // links — v4.5.67: sanitize URL to prevent javascript: scheme injection
+            html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (match, text, url) => {
+                const safeUrl = /^(https?:\/\/|mailto:|\/|#)/.test(url) ? url : '#';
+                return `<a href="${safeUrl}" target="_blank" style="color:var(--info-color)">${text}</a>`;
+            });
             // horizontal rules
             html = html.replace(/^---$/gm, '<hr style="border-color:var(--border-color);margin:8px 0">');
             // unordered lists
-- 
cgit v1.2.3