From 5b1caf046ceddc84ff2cedb6b5db91844ef425d3 Mon Sep 17 00:00:00 2001
From: thzxx <thzxx@users.noreply.gitee.com>
Date: Mon, 18 May 2026 13:58:38 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20shell.openExternal=20=E6=B7=BB=E5=8A=A0?=
 =?UTF-8?q?=E5=8D=8F=E8=AE=AE=E7=99=BD=E5=90=8D=E5=8D=95=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

仅允许 http/https 协议，阻止 javascript: 等潜在恶意链接。
---
 renderer/renderer.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/renderer/renderer.js b/renderer/renderer.js
index b73b181..49f61f6 100644
--- a/renderer/renderer.js
+++ b/renderer/renderer.js
@@ -142,6 +142,14 @@
         if (target) target.scrollIntoView({ behavior: 'smooth' });
         return;
       }
+      // Only allow http/https protocols
+      try {
+        const url = new URL(href);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return;
+      } catch {
+        // Relative URLs fail new URL(), but we already handled anchors above
+        return;
+      }
       // External links: open in system browser
       if (typeof window.electronAPI !== 'undefined' && window.electronAPI.openExternal) {
         window.electronAPI.openExternal(href);