@conduction/nextcloud-vue 2.56.0-beta.3 → 2.56.0-beta.5

package/src/integrations/builtin/cospend/CnCospendTab.vue

@@ -75,8 +75,7 @@
 			<NcButton
 				variant="primary"
 				:href="cospendAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<CurrencyEur :size="20" />
 				</template>
@@ -175,7 +174,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import CnCospendCreate from '../../../components/CnCospendCreate/CnCospendCreate.vue'
 import CnCospendPicker from '../../../components/CnCospendPicker/CnCospendPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnCospendTab — bespoke sidebar tab for the `cospend` integration.
@@ -389,7 +388,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const projectId = row.projectId ?? row.project_id ?? row.data?.projectid ?? row.data?.project_id ?? null

package/src/integrations/builtin/deck/CnDeckCard.vue

@@ -110,7 +110,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import ViewColumnOutline from 'vue-material-design-icons/ViewColumnOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -276,7 +276,7 @@ export default {
 		},
 
 		cardUrl(card) {
-			if (card.url) {
+			if (card.url && safeHref(card.url) !== '#') {
 				return card.url
 			}
 			const boardId = card.boardId ?? card.board?.id ?? ''

package/src/integrations/builtin/deck/CnDeckTab.vue

@@ -58,8 +58,7 @@
 			<NcButton
 				variant="primary"
 				:href="deckAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ViewColumnOutline :size="20" />
 				</template>
@@ -168,7 +167,7 @@ import ViewColumnOutline from 'vue-material-design-icons/ViewColumnOutline.vue'
 import CnDeckCardCreate from '../../../components/CnDeckCardCreate/CnDeckCardCreate.vue'
 import CnDeckCardPicker from '../../../components/CnDeckCardPicker/CnDeckCardPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /** Maximum assignee avatars shown before collapsing the rest into a +N overflow badge. */
 const MAX_VISIBLE_ASSIGNEES = 3
@@ -353,7 +352,7 @@ export default {
 		},
 
 		cardUrl(card) {
-			if (card.url) {
+			if (card.url && safeHref(card.url) !== '#') {
 				return card.url
 			}
 			const boardId = card.boardId ?? card.board?.id ?? ''

package/src/integrations/builtin/email/CnEmailCard.vue

@@ -321,7 +321,6 @@ export default {
 	background: none;
 	border: none;
 	padding: 6px 0;
-	cursor: pointer;
 	text-align: left;
 	color: inherit;
 	font: inherit;
@@ -329,7 +328,12 @@ export default {
 	box-sizing: border-box;
 }
 
-.cn-email-card__open:hover .cn-email-card__subject {
+/* Only a row with Mail ids is a link; the rest must not look clickable. */
+a.cn-email-card__open {
+	cursor: pointer;
+}
+
+a.cn-email-card__open:hover .cn-email-card__subject {
 	color: var(--color-primary-element);
 }
 

package/src/integrations/builtin/email/CnEmailTab.vue

@@ -27,8 +27,7 @@
 			<NcButton
 				variant="primary"
 				:href="composeUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<EmailEditOutline :size="18" />
 				</template>
@@ -497,11 +496,15 @@ export default {
 	border-radius: var(--border-radius-large, 8px);
 	color: inherit;
 	text-decoration: none;
-	cursor: pointer;
 	position: relative;
 }
 
-.cn-email-tab__row:hover {
+/* Only a row with Mail ids is a link; the rest must not look clickable. */
+a.cn-email-tab__row {
+	cursor: pointer;
+}
+
+a.cn-email-tab__row:hover {
 	background-color: var(--color-background-hover);
 }
 

package/src/integrations/builtin/flow/CnFlowCard.vue

@@ -104,7 +104,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import SitemapOutline from 'vue-material-design-icons/SitemapOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -239,7 +239,7 @@ export default {
 		},
 
 		opUrl(op) {
-			return op.url || this.flowSettingsUrl
+			return op.url && safeHref(op.url) !== '#' ? op.url : this.flowSettingsUrl
 		},
 
 		shortClass(className) {

package/src/integrations/builtin/flow/CnFlowTab.vue

@@ -58,8 +58,7 @@
 			<NcButton
 				variant="primary"
 				:href="flowSettingsUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<SitemapOutline :size="20" />
 				</template>
@@ -139,7 +138,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import SitemapOutline from 'vue-material-design-icons/SitemapOutline.vue'
 import CnFlowOperationPicker from '../../../components/CnFlowOperationPicker/CnFlowOperationPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnFlowTab — bespoke automation-rule list for the `flow` integration.
@@ -218,7 +217,7 @@ export default {
 		},
 
 		opUrl(op) {
-			return op.url || this.flowSettingsUrl
+			return op.url && safeHref(op.url) !== '#' ? op.url : this.flowSettingsUrl
 		},
 
 		shortClass(className) {

package/src/integrations/builtin/forms/CnFormsCard.vue

@@ -100,7 +100,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import ClipboardText from 'vue-material-design-icons/ClipboardText.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -289,8 +289,9 @@ export default {
 			return form.title || form.id || t('nextcloud-vue', 'Untitled form')
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		formUrl(form) {
-			if (form.url) {
+			if (form.url && safeHref(form.url) !== '#') {
 				return form.url
 			}
 			if (form.hash) {

package/src/integrations/builtin/forms/CnFormsTab.vue

@@ -67,8 +67,7 @@
 			<NcButton
 				variant="primary"
 				:href="formsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ClipboardText :size="20" />
 				</template>
@@ -118,8 +117,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="formUrl(form)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -168,7 +166,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
 import CnFormCreate from './CnFormCreate.vue'
 import CnFormPicker from './CnFormPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnFormsTab — bespoke linked-forms list for the Tier-2 `forms` leaf.
@@ -332,8 +330,9 @@ export default {
 			return form.description || ''
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		formUrl(form) {
-			if (form.url) {
+			if (form.url && safeHref(form.url) !== '#') {
 				return form.url
 			}
 			if (form.hash) {

package/src/integrations/builtin/maps/CnMapsCard.vue

@@ -125,7 +125,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import MapMarker from 'vue-material-design-icons/MapMarker.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -291,8 +291,9 @@ export default {
 			return `${lat.toFixed(5)}, ${lng.toFixed(5)}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pointUrl(point) {
-			if (typeof point.url === 'string' && point.url !== '') {
+			if (typeof point.url === 'string' && point.url !== '' && safeHref(point.url) !== '#') {
 				return point.url
 			}
 			const lat = this.pointLat(point)

package/src/integrations/builtin/maps/CnMapsTab.vue

@@ -86,8 +86,7 @@
 			<NcButton
 				variant="primary"
 				:href="mapsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<MapMarker :size="20" />
 				</template>
@@ -146,8 +145,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="pointUrl(point)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -188,7 +186,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnMapPoiCreate from '../../../components/CnMapPoiCreate/CnMapPoiCreate.vue'
 import CnMapPoiPicker from '../../../components/CnMapPoiPicker/CnMapPoiPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const COMMENT_MAX_CHARS = 160
@@ -389,8 +387,9 @@ export default {
 			return `${lat.toFixed(5)}, ${lng.toFixed(5)}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pointUrl(point) {
-			if (typeof point.url === 'string' && point.url !== '') {
+			if (typeof point.url === 'string' && point.url !== '' && safeHref(point.url) !== '#') {
 				return point.url
 			}
 			if (this.pointHasCoords(point)) {

package/src/integrations/builtin/maps/__tests__/CnMapsTab.spec.js

@@ -45,6 +45,15 @@ describe('CnMapsTab', () => {
 		delete global.fetch
 	})
 
+	it('links to the Maps app instead of a provider URL with an unsafe scheme', async () => {
+		global.fetch = jest.fn().mockResolvedValueOnce({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
+		const wrapper = mount(CnMapsTab, { propsData: { ...DEFAULT_PROPS } })
+		await flushPromises()
+		expect(wrapper.vm.pointUrl({ url: 'javascript:alert(1)' })).toBe('/index.php/apps/maps')
+		expect(wrapper.vm.pointUrl({ url: 'https://maps.example/p/1' })).toBe('https://maps.example/p/1')
+		wrapper.unmount()
+	})
+
 	it('renders the empty state with an "Open Locations" CTA when no points', async () => {
 		global.fetch = jest.fn().mockResolvedValueOnce({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
 		const wrapper = mount(CnMapsTab, { propsData: { ...DEFAULT_PROPS } })

package/src/integrations/builtin/openproject/CnOpenprojectCard.vue

@@ -156,7 +156,7 @@ import Briefcase from 'vue-material-design-icons/Briefcase.vue'
 import CheckCircleOutline from 'vue-material-design-icons/CheckCircleOutline.vue'
 import LockOutline from 'vue-material-design-icons/LockOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -338,7 +338,8 @@ export default {
 		},
 
 		wpUrl(wp) {
-			return wp.url ?? wp._links?.self?.href ?? this.openprojectAppUrl
+			const url = wp.url ?? wp._links?.self?.href
+			return url && safeHref(url) !== '#' ? url : this.openprojectAppUrl
 		},
 
 		wpStatus(wp) {

package/src/integrations/builtin/openproject/CnOpenprojectTab.vue

@@ -85,8 +85,7 @@
 			<NcButton
 				variant="primary"
 				:href="openconnectorUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<CogOutline :size="20" />
 				</template>
@@ -104,8 +103,7 @@
 			<NcButton
 				variant="secondary"
 				:href="openprojectAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<OpenInNew :size="20" />
 				</template>
@@ -233,7 +231,7 @@ import StarFourPointsOutline from 'vue-material-design-icons/StarFourPointsOutli
 import CnOpenProjectCreate from '../../../components/CnOpenProjectCreate/CnOpenProjectCreate.vue'
 import CnOpenProjectPicker from '../../../components/CnOpenProjectPicker/CnOpenProjectPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnOpenprojectTab — bespoke sidebar tab for the `openproject` integration.
@@ -549,7 +547,8 @@ export default {
 		},
 
 		wpUrl(wp) {
-			return wp.url ?? wp._links?.self?.href ?? this.openprojectAppUrl
+			const url = wp.url ?? wp._links?.self?.href
+			return url && safeHref(url) !== '#' ? url : this.openprojectAppUrl
 		},
 
 		wpStatus(wp) {

package/src/integrations/builtin/photos/CnPhotosCard.vue

@@ -128,7 +128,7 @@ import { NcLoadingIcon } from '@nextcloud/vue'
 import ImageIcon from 'vue-material-design-icons/Image.vue'
 import ImageMultiple from 'vue-material-design-icons/ImageMultiple.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 4
@@ -265,7 +265,7 @@ export default {
 		},
 
 		albumUrl(album) {
-			if (album && album.url) {
+			if (album && album.url && safeHref(album.url) !== '#') {
 				return album.url
 			}
 			const name = this.albumName(album)

package/src/integrations/builtin/photos/CnPhotosTab.vue

@@ -72,8 +72,7 @@
 			<NcButton
 				variant="primary"
 				:href="photosAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ImageIcon :size="20" />
 				</template>
@@ -154,7 +153,7 @@ import LinkVariant from 'vue-material-design-icons/LinkVariant.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnPhotoAlbumCreate from '../../../components/CnPhotoAlbumCreate/CnPhotoAlbumCreate.vue'
 import CnPhotoAlbumPicker from '../../../components/CnPhotoAlbumPicker/CnPhotoAlbumPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnPhotosTab — bespoke album grid for the `photos` integration.
@@ -262,7 +261,7 @@ export default {
 		},
 
 		albumUrl(album) {
-			if (album && album.url) {
+			if (album && album.url && safeHref(album.url) !== '#') {
 				return album.url
 			}
 			const id = this.albumKey(album)

package/src/integrations/builtin/polls/CnPollsCard.vue

@@ -129,7 +129,7 @@ import FormatListChecks from 'vue-material-design-icons/FormatListChecks.vue'
 import Poll from 'vue-material-design-icons/Poll.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -266,7 +266,7 @@ export default {
 		},
 
 		pollUrl(poll) {
-			if (poll.url) {
+			if (poll.url && safeHref(poll.url) !== '#') {
 				return poll.url
 			}
 			const id = poll.id ?? ''

package/src/integrations/builtin/polls/CnPollsTab.vue

@@ -63,8 +63,7 @@
 			<NcButton
 				variant="primary"
 				:href="pollsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<Poll :size="20" />
 				</template>
@@ -179,7 +178,7 @@ import Poll from 'vue-material-design-icons/Poll.vue'
 import CnPollCreate from '../../../components/CnPollCreate/CnPollCreate.vue'
 import CnPollPicker from '../../../components/CnPollPicker/CnPollPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 /**
@@ -365,7 +364,7 @@ export default {
 		},
 
 		pollUrl(poll) {
-			if (poll.url) {
+			if (poll.url && safeHref(poll.url) !== '#') {
 				return poll.url
 			}
 			const id = this.pollKey(poll)

package/src/integrations/builtin/shares/CnSharesTab.vue

@@ -50,8 +50,7 @@
 			<NcButton
 				variant="primary"
 				:href="filesAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<FolderOutline :size="20" />
 				</template>
@@ -125,8 +124,7 @@
 							<NcActionLink
 								:closeAfterClick="true"
 								:href="filesAppUrl"
-								target="_blank"
-								rel="noopener noreferrer">
+								target="_blank">
 								<template #icon>
 									<FolderOutline :size="20" />
 								</template>
@@ -140,8 +138,7 @@
 				<NcButton
 					variant="tertiary"
 					:href="filesAppUrl"
-					target="_blank"
-					rel="noopener noreferrer">
+					target="_blank">
 					<template #icon>
 						<FolderOutline :size="18" />
 					</template>

package/src/integrations/builtin/talk/CnTalkCard.vue

@@ -111,7 +111,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcAvatar, NcCounterBubble, NcLoadingIcon } from '@nextcloud/vue'
 import ChatOutline from 'vue-material-design-icons/ChatOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -252,8 +252,9 @@ export default {
 			return stripMarker(raw) || String(this.roomKey(room))
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		roomUrl(room) {
-			if (room.url) {
+			if (room.url && safeHref(room.url) !== '#') {
 				return room.url
 			}
 			const token = room.token ?? room.id ?? ''

package/src/integrations/builtin/talk/CnTalkTab.vue

@@ -60,8 +60,7 @@
 			<NcButton
 				variant="primary"
 				:href="talkAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ChatOutline :size="20" />
 				</template>
@@ -107,8 +106,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="roomUrl(room)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -149,7 +147,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnTalkRoomCreate from '../../../components/CnTalkRoomCreate/CnTalkRoomCreate.vue'
 import CnTalkRoomPicker from '../../../components/CnTalkRoomPicker/CnTalkRoomPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 /**
@@ -247,8 +245,9 @@ export default {
 			return stripMarker(raw) || String(this.roomKey(room))
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		roomUrl(room) {
-			if (room.url) {
+			if (room.url && safeHref(room.url) !== '#') {
 				return room.url
 			}
 			const token = room.roomToken ?? room.token ?? room.id ?? ''

package/src/integrations/builtin/time-tracker/CnTimeTrackerCard.vue

@@ -119,7 +119,7 @@ import { NcLoadingIcon } from '@nextcloud/vue'
 import Clock from 'vue-material-design-icons/Clock.vue'
 import Timer from 'vue-material-design-icons/Timer.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -307,7 +307,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const kind = this.rowKind(row)

package/src/integrations/builtin/time-tracker/CnTimeTrackerTab.vue

@@ -81,8 +81,7 @@
 			<NcButton
 				variant="primary"
 				:href="timeTrackerAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<Clock :size="20" />
 				</template>
@@ -185,7 +184,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import Timer from 'vue-material-design-icons/Timer.vue'
 import CnTimeTrackerCreate from '../../../components/CnTimeTrackerCreate/CnTimeTrackerCreate.vue'
 import CnTimeTrackerPicker from '../../../components/CnTimeTrackerPicker/CnTimeTrackerPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnTimeTrackerTab — bespoke sidebar tab for the `time-tracker`
@@ -361,7 +360,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const kind = this.rowKind(row)

package/src/integrations/builtin/xwiki/CnXwikiCard.vue

@@ -138,7 +138,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import FileDocumentMultiple from 'vue-material-design-icons/FileDocumentMultiple.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const PREVIEW_MAX_CHARS = 500
@@ -303,8 +303,10 @@ export default {
 			return String(page.title ?? page.page ?? page.reference ?? this.pageKey(page))
 		},
 
+		// An unsafe scheme is treated like a missing URL.
 		pageUrl(page) {
-			return page.url ?? ''
+			const url = page.url ?? ''
+			return url && safeHref(url) !== '#' ? url : ''
 		},
 
 		breadcrumbLabel(page) {