fix: shell.openExternal 添加协议白名单校验

仅允许 http/https 协议，阻止 javascript: 等潜在恶意链接。
2026-05-18 13:58:38 +08:00
parent aac6a0b073
commit 5b1caf046c
1 changed files with 8 additions and 0 deletions
@@ -142,6 +142,14 @@
        if (target) target.scrollIntoView({ behavior: 'smooth' });
        return;
      }
+      // Only allow http/https protocols
+      try {
+        const url = new URL(href);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return;
+      } catch {
+        // Relative URLs fail new URL(), but we already handled anchors above
+        return;
+      }
      // External links: open in system browser
      if (typeof window.electronAPI !== 'undefined' && window.electronAPI.openExternal) {
        window.electronAPI.openExternal(href);