From 4534f130b30469e1b6cf700ad516fcdf27cdceee Mon Sep 17 00:00:00 2001 From: ayn2op Date: Mon, 12 Oct 2026 12:24:42 -0400 Subject: [PATCH] fix(messageslist): open only http and https links --- internal/ui/chat/messageslist/model.go | 9 ++++++++- internal/ui/chat/messageslist/model_test.go | 8 ++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/internal/ui/chat/messageslist/model.go b/internal/ui/chat/messageslist/model.go index ebea3a8..a507e7e 100644 --- a/internal/ui/chat/messageslist/model.go +++ b/internal/ui/chat/messageslist/model.go @@ -1135,6 +1135,12 @@ func extractEmbedURLs(embeds []discord.Embed) []string { return urls } +// The schemes of the links that are opened. +const ( + schemeHTTP = "http" + schemeHTTPS = "https" +) + func messageURLs(msg discord.Message) []string { combined := slices.Concat(extractURLs(msg.Content), extractEmbedURLs(msg.Embeds)) @@ -1142,7 +1148,8 @@ func messageURLs(msg discord.Message) []string { seen := make(map[string]struct{}, len(combined)) for _, u := range combined { u = strings.TrimSpace(u) - if u == "" { + // Only web links are opened, as one of another scheme could run a program. + if parsed, err := url.Parse(u); err != nil || parsed.Scheme != schemeHTTP && parsed.Scheme != schemeHTTPS { continue } if _, ok := seen[u]; ok { diff --git a/internal/ui/chat/messageslist/model_test.go b/internal/ui/chat/messageslist/model_test.go index 54594fe..b5cf794 100644 --- a/internal/ui/chat/messageslist/model_test.go +++ b/internal/ui/chat/messageslist/model_test.go @@ -190,3 +190,11 @@ func TestWaveformRail(t *testing.T) { t.Errorf("got %q, want %q", got, want) } } + +func TestMessageURLs(t *testing.T) { + message := discord.Message{Content: "[a](file:///etc/passwd) [b](ms-msdt:id) [c](HTTPS://example.com) https://example.org"} + + if got, want := messageURLs(message), []string{"HTTPS://example.com", "https://example.org"}; !slices.Equal(got, want) { + t.Errorf("got %q, want %q", got, want) + } +}