Classic298andGitHub 2a44c9d384 refac: validate the URL scheme before rendering a link href (#29890) ...

Link URLs rendered from markdown, citations and web search results now pass a scheme check before they reach an anchor. A new safeLinkUrl helper sits beside isValidHttpUrl and keeps http, https, mailto, tel and relative URLs, returning undefined for anything else so the label renders without a link. Markdown links with an unusual scheme (ftp, sms, and application deep links such as obsidian or vscode) render as plain text from now on.

The citation checks move off a substring test for "http" onto isValidHttpUrl, which is what Citations.svelte already uses for the same question. That also drops two long-standing quirks: an uppercase HTTP:// source never rendered as a link, and a filename merely containing "http" rendered as a dead external one.

2026-09-12 16:06:58 -05:00

..

lib

refac: validate the URL scheme before rendering a link href (#29890)

2026-09-12 16:06:58 -05:00

routes

refac

2026-09-09 19:16:16 -04:00

app.css

refac

2026-09-10 19:05:36 -04:00

app.d.ts

…

app.html

…

tailwind.css

…