@conduction/nextcloud-vue 2.58.0 → 2.59.0

package/src/components/CnTasksWidget/CnTasksWidget.vue

@@ -31,6 +31,7 @@
 					class="cn-tasks-widget__row"
 					:data-state="task.state"
 					@click="onRowClick(task, $event)"
+					@mousedown="preventMiddleClickAutoscroll"
 					@auxclick="onRowAuxClick(task, $event)">
 					<span class="cn-tasks-widget__body">
 						<span class="cn-tasks-widget__name">{{ titleOf(task) }}</span>
@@ -90,7 +91,7 @@ import { inject, ref } from 'vue'
 import { taskDeepLink, taskDueLabel } from '../../composables/indexSources.js'
 import { useEndpointSource } from '../../composables/useEndpointSource.js'
 import { openRowTarget } from '../../utils/linkNavigation.js'
-import { isRowMiddleClick } from '../../utils/rowAuxClick.js'
+import { isRowMiddleClick, preventMiddleClickAutoscroll } from '../../utils/rowAuxClick.js'
 
 /**
  * The OpenRegister inbox read (openregister flow-task-entity). One endpoint
@@ -367,6 +368,8 @@ export default {
 	},
 
 	methods: {
+		preventMiddleClickAutoscroll,
+
 		/**
 		 * Start (or restart) the refetch interval, unless polling is off.
 		 *

package/src/css/table.css

@@ -334,6 +334,32 @@
 	background-color: var(--color-primary-light);
 }
 
+/* A row with a route is a real link (see CnDataTable's row link): the anchor
+   in its first cell is stretched over the whole row. The row's own controls
+   sit above it so they stay usable; keep the list in step with NESTED_CONTROL
+   in utils/rowAuxClick.js. */
+.cn-table-row--linked {
+	position: relative;
+}
+
+.cn-table-row__link {
+	position: absolute;
+	inset: 0;
+	cursor: pointer;
+}
+
+.cn-table-row__link:focus-visible {
+	outline: 2px solid var(--color-main-text);
+	outline-offset: -2px;
+}
+
+.cn-table-row--linked .cn-table-col--checkbox,
+.cn-table-row--linked .cn-table-col--actions,
+.cn-table-row--linked td :is(a, button, input, select, textarea, label, summary, [role='button'], [role='checkbox'], [role='link'], [contenteditable='true']):not(.cn-table-row__link) {
+	position: relative;
+	z-index: 1;
+}
+
 /* Column Types */
 .cn-table-col--checkbox {
 	width: 50px;

package/src/integrations/builtin/analytics/CnAnalyticsCard.vue

@@ -122,7 +122,7 @@ import ChartPie from 'vue-material-design-icons/ChartPie.vue'
 import TableIcon from 'vue-material-design-icons/Table.vue'
 import ViewDashboard from 'vue-material-design-icons/ViewDashboard.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -287,8 +287,9 @@ export default {
 			return `cn-analytics-card__badge--type-${type ?? 'unknown'}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		reportUrl(report) {
-			if (report && report.url) {
+			if (report && report.url && safeHref(report.url) !== '#') {
 				return report.url
 			}
 			const id = this.reportKey(report)

package/src/integrations/builtin/analytics/CnAnalyticsTab.vue

@@ -82,8 +82,7 @@
 			<NcButton
 				variant="primary"
 				:href="analyticsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ChartBar :size="20" />
 				</template>
@@ -131,8 +130,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="reportUrl(report)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -178,7 +176,7 @@ import ViewDashboard from 'vue-material-design-icons/ViewDashboard.vue'
 import CnAnalyticsReportCreate from '../../../components/CnAnalyticsReportCreate/CnAnalyticsReportCreate.vue'
 import CnAnalyticsReportPicker from '../../../components/CnAnalyticsReportPicker/CnAnalyticsReportPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnAnalyticsTab — bespoke dataset list for the `analytics` integration.
@@ -408,8 +406,9 @@ export default {
 			return t('nextcloud-vue', 'Latest value')
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		reportUrl(report) {
-			if (report && report.url) {
+			if (report && report.url && safeHref(report.url) !== '#') {
 				return report.url
 			}
 			const id = this.reportKey(report)

package/src/integrations/builtin/bookmarks/CnBookmarksCard.vue

@@ -34,9 +34,11 @@
 					@error="onFaviconError(entity)">
 				<Bookmark v-else :size="14" />
 				<a
+					v-if="hasSafeUrl(entity)"
 					:href="entity.url"
 					target="_blank"
 					rel="noopener noreferrer">{{ bookmarkTitle(entity) }}</a>
+				<span v-else>{{ bookmarkTitle(entity) }}</span>
 			</span>
 			<span v-else class="cn-bookmarks-card__empty">{{ emptyLabel }}</span>
 		</template>
@@ -62,9 +64,11 @@
 						@error="onFaviconError(mostRecent)">
 					<Bookmark v-else :size="14" />
 					<a
+						v-if="hasSafeUrl(mostRecent)"
 						:href="mostRecent.url"
 						target="_blank"
 						rel="noopener noreferrer">{{ bookmarkTitle(mostRecent) }}</a>
+					<span v-else>{{ bookmarkTitle(mostRecent) }}</span>
 				</div>
 				<div v-if="bookmarks.length > 1" class="cn-bookmarks-card__view-all">
 					<a
@@ -99,10 +103,12 @@
 					</div>
 					<div class="cn-bookmarks-card__row-main">
 						<a
+							v-if="hasSafeUrl(bookmark)"
 							:href="bookmark.url"
 							target="_blank"
 							rel="noopener noreferrer"
 							class="cn-bookmarks-card__title">{{ bookmarkTitle(bookmark) }}</a>
+						<span v-else class="cn-bookmarks-card__title">{{ bookmarkTitle(bookmark) }}</span>
 					</div>
 				</li>
 			</ul>
@@ -121,7 +127,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import Bookmark from 'vue-material-design-icons/Bookmark.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -245,6 +251,11 @@ export default {
 			return bookmark.title || bookmark.url || ''
 		},
 
+		// Bookmark URLs are user-entered (bookmarklets are `javascript:`), so only a safe one is a link.
+		hasSafeUrl(bookmark) {
+			return safeHref(bookmark.url) !== '#'
+		},
+
 		chipSubtitle(bookmark) {
 			return bookmark.description || bookmark.url || this.bookmarkTitle(bookmark)
 		},

package/src/integrations/builtin/bookmarks/CnBookmarksTab.vue

@@ -57,8 +57,7 @@
 			<NcButton
 				variant="primary"
 				:href="bookmarksAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<Bookmark :size="20" />
 				</template>
@@ -92,8 +91,9 @@
 					:name="bookmarkTitle(bookmark)"
 					:bold="true"
 					:href="bookmarkHref(bookmark)"
-					target="_blank"
-					:forceDisplayActions="true">
+					:target="hasSafeUrl(bookmark) ? '_blank' : undefined"
+					:forceDisplayActions="true"
+					@click="onBookmarkClick(bookmark, $event)">
 					<template #icon>
 						<span class="cn-bookmarks-tab__row-icon">
 							<Bookmark :size="20" />
@@ -121,10 +121,10 @@
 					</template>
 					<template #actions>
 						<NcActionLink
+							v-if="hasSafeUrl(bookmark)"
 							:closeAfterClick="true"
 							:href="bookmarkHref(bookmark)"
-							target="_blank"
-							rel="noopener noreferrer">
+							target="_blank">
 							<template #icon>
 								<OpenInNew :size="20" />
 							</template>
@@ -393,6 +393,23 @@ export default {
 			return safeHref(bookmark.url)
 		},
 
+		/**
+		 * Whether the bookmark's URL passed `safeHref`, so its row is a link.
+		 *
+		 * @param {object} bookmark The bookmark row.
+		 * @return {boolean}
+		 */
+		hasSafeUrl(bookmark) {
+			return this.bookmarkHref(bookmark) !== '#'
+		},
+
+		// NcListItem always renders an anchor; one without a safe URL must not follow `#`.
+		onBookmarkClick(bookmark, event) {
+			if (!this.hasSafeUrl(bookmark)) {
+				event?.preventDefault?.()
+			}
+		},
+
 		bookmarkTags(bookmark) {
 			const tags = bookmark.tags
 			if (!Array.isArray(tags)) {

package/src/integrations/builtin/bookmarks/__tests__/CnBookmarksTab.spec.js

@@ -78,7 +78,7 @@ describe('CnBookmarksTab', () => {
 		expect(openLink.attributes('target')).toBe('_blank')
 	})
 
-	it('neutralises unsafe bookmark URL schemes in the row and action hrefs', async () => {
+	it('renders a bookmark with an unsafe URL as an inert row with no Open action', async () => {
 		global.fetch = jest.fn().mockResolvedValueOnce({
 			ok: true,
 			status: 200,
@@ -90,7 +90,12 @@ describe('CnBookmarksTab', () => {
 		await flushPromises()
 		const row = wrapper.find('.cn-bookmarks-tab__row')
 		expect(row.attributes('href')).toBe('#')
-		expect(row.find('.stub.NcActionLink').attributes('href')).toBe('#')
+		expect(row.attributes('target')).toBeUndefined()
+		expect(row.find('.stub.NcActionLink').exists()).toBe(false)
+
+		const event = { preventDefault: jest.fn() }
+		wrapper.vm.onBookmarkClick(wrapper.vm.filteredBookmarks[0], event)
+		expect(event.preventDefault).toHaveBeenCalled()
 		wrapper.unmount()
 	})
 

package/src/integrations/builtin/collectives/CnCollectivesCard.vue

@@ -126,7 +126,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import BookOpenPageVariant from 'vue-material-design-icons/BookOpenPageVariant.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -263,8 +263,9 @@ export default {
 			return typeof emoji === 'string' ? emoji.trim() : ''
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pageUrl(page) {
-			if (typeof page.url === 'string' && page.url !== '') {
+			if (typeof page.url === 'string' && page.url !== '' && safeHref(page.url) !== '#') {
 				return page.url
 			}
 			const d = this.dataOf(page)

package/src/integrations/builtin/collectives/CnCollectivesTab.vue

@@ -72,8 +72,7 @@
 			<NcButton
 				variant="primary"
 				:href="collectivesAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<BookOpenPageVariant :size="20" />
 				</template>
@@ -122,8 +121,7 @@
 							<NcActionLink
 								:closeAfterClick="true"
 								:href="pageUrl(page)"
-								target="_blank"
-								rel="noopener noreferrer">
+								target="_blank">
 								<template #icon>
 									<OpenInNew :size="20" />
 								</template>
@@ -168,7 +166,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnCollectivePageCreate from '../../../components/CnCollectivePageCreate/CnCollectivePageCreate.vue'
 import CnCollectivePagePicker from '../../../components/CnCollectivePagePicker/CnCollectivePagePicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const MS_PER_DAY = 24 * 60 * 60 * 1000
@@ -333,8 +331,9 @@ export default {
 			return text
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pageUrl(page) {
-			if (typeof page.url === 'string' && page.url !== '') {
+			if (typeof page.url === 'string' && page.url !== '' && safeHref(page.url) !== '#') {
 				return page.url
 			}
 			const d = this.dataOf(page)

package/src/integrations/builtin/cospend/CnCospendCard.vue

@@ -108,7 +108,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import CurrencyEur from 'vue-material-design-icons/CurrencyEur.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -250,7 +250,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const projectId = row.projectId ?? row.project_id ?? row.data?.projectid ?? row.data?.project_id ?? null

package/src/integrations/builtin/cospend/CnCospendTab.vue

@@ -75,8 +75,7 @@
 			<NcButton
 				variant="primary"
 				:href="cospendAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<CurrencyEur :size="20" />
 				</template>
@@ -175,7 +174,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import CnCospendCreate from '../../../components/CnCospendCreate/CnCospendCreate.vue'
 import CnCospendPicker from '../../../components/CnCospendPicker/CnCospendPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnCospendTab — bespoke sidebar tab for the `cospend` integration.
@@ -389,7 +388,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const projectId = row.projectId ?? row.project_id ?? row.data?.projectid ?? row.data?.project_id ?? null

package/src/integrations/builtin/deck/CnDeckCard.vue

@@ -110,7 +110,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import ViewColumnOutline from 'vue-material-design-icons/ViewColumnOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -276,7 +276,7 @@ export default {
 		},
 
 		cardUrl(card) {
-			if (card.url) {
+			if (card.url && safeHref(card.url) !== '#') {
 				return card.url
 			}
 			const boardId = card.boardId ?? card.board?.id ?? ''

package/src/integrations/builtin/deck/CnDeckTab.vue

@@ -58,8 +58,7 @@
 			<NcButton
 				variant="primary"
 				:href="deckAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ViewColumnOutline :size="20" />
 				</template>
@@ -168,7 +167,7 @@ import ViewColumnOutline from 'vue-material-design-icons/ViewColumnOutline.vue'
 import CnDeckCardCreate from '../../../components/CnDeckCardCreate/CnDeckCardCreate.vue'
 import CnDeckCardPicker from '../../../components/CnDeckCardPicker/CnDeckCardPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /** Maximum assignee avatars shown before collapsing the rest into a +N overflow badge. */
 const MAX_VISIBLE_ASSIGNEES = 3
@@ -353,7 +352,7 @@ export default {
 		},
 
 		cardUrl(card) {
-			if (card.url) {
+			if (card.url && safeHref(card.url) !== '#') {
 				return card.url
 			}
 			const boardId = card.boardId ?? card.board?.id ?? ''

package/src/integrations/builtin/email/CnEmailCard.vue

@@ -321,7 +321,6 @@ export default {
 	background: none;
 	border: none;
 	padding: 6px 0;
-	cursor: pointer;
 	text-align: left;
 	color: inherit;
 	font: inherit;
@@ -329,7 +328,12 @@ export default {
 	box-sizing: border-box;
 }
 
-.cn-email-card__open:hover .cn-email-card__subject {
+/* Only a row with Mail ids is a link; the rest must not look clickable. */
+a.cn-email-card__open {
+	cursor: pointer;
+}
+
+a.cn-email-card__open:hover .cn-email-card__subject {
 	color: var(--color-primary-element);
 }
 

package/src/integrations/builtin/email/CnEmailTab.vue

@@ -27,8 +27,7 @@
 			<NcButton
 				variant="primary"
 				:href="composeUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<EmailEditOutline :size="18" />
 				</template>
@@ -497,11 +496,15 @@ export default {
 	border-radius: var(--border-radius-large, 8px);
 	color: inherit;
 	text-decoration: none;
-	cursor: pointer;
 	position: relative;
 }
 
-.cn-email-tab__row:hover {
+/* Only a row with Mail ids is a link; the rest must not look clickable. */
+a.cn-email-tab__row {
+	cursor: pointer;
+}
+
+a.cn-email-tab__row:hover {
 	background-color: var(--color-background-hover);
 }
 

package/src/integrations/builtin/flow/CnFlowCard.vue

@@ -104,7 +104,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import SitemapOutline from 'vue-material-design-icons/SitemapOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -239,7 +239,7 @@ export default {
 		},
 
 		opUrl(op) {
-			return op.url || this.flowSettingsUrl
+			return op.url && safeHref(op.url) !== '#' ? op.url : this.flowSettingsUrl
 		},
 
 		shortClass(className) {

package/src/integrations/builtin/flow/CnFlowTab.vue

@@ -58,8 +58,7 @@
 			<NcButton
 				variant="primary"
 				:href="flowSettingsUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<SitemapOutline :size="20" />
 				</template>
@@ -139,7 +138,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import SitemapOutline from 'vue-material-design-icons/SitemapOutline.vue'
 import CnFlowOperationPicker from '../../../components/CnFlowOperationPicker/CnFlowOperationPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnFlowTab — bespoke automation-rule list for the `flow` integration.
@@ -218,7 +217,7 @@ export default {
 		},
 
 		opUrl(op) {
-			return op.url || this.flowSettingsUrl
+			return op.url && safeHref(op.url) !== '#' ? op.url : this.flowSettingsUrl
 		},
 
 		shortClass(className) {

package/src/integrations/builtin/forms/CnFormsCard.vue

@@ -100,7 +100,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import ClipboardText from 'vue-material-design-icons/ClipboardText.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -289,8 +289,9 @@ export default {
 			return form.title || form.id || t('nextcloud-vue', 'Untitled form')
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		formUrl(form) {
-			if (form.url) {
+			if (form.url && safeHref(form.url) !== '#') {
 				return form.url
 			}
 			if (form.hash) {

package/src/integrations/builtin/forms/CnFormsTab.vue

@@ -67,8 +67,7 @@
 			<NcButton
 				variant="primary"
 				:href="formsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ClipboardText :size="20" />
 				</template>
@@ -118,8 +117,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="formUrl(form)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -168,7 +166,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
 import CnFormCreate from './CnFormCreate.vue'
 import CnFormPicker from './CnFormPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnFormsTab — bespoke linked-forms list for the Tier-2 `forms` leaf.
@@ -332,8 +330,9 @@ export default {
 			return form.description || ''
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		formUrl(form) {
-			if (form.url) {
+			if (form.url && safeHref(form.url) !== '#') {
 				return form.url
 			}
 			if (form.hash) {

package/src/integrations/builtin/maps/CnMapsCard.vue

@@ -125,7 +125,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import MapMarker from 'vue-material-design-icons/MapMarker.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -291,8 +291,9 @@ export default {
 			return `${lat.toFixed(5)}, ${lng.toFixed(5)}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pointUrl(point) {
-			if (typeof point.url === 'string' && point.url !== '') {
+			if (typeof point.url === 'string' && point.url !== '' && safeHref(point.url) !== '#') {
 				return point.url
 			}
 			const lat = this.pointLat(point)

package/src/integrations/builtin/maps/CnMapsTab.vue

@@ -86,8 +86,7 @@
 			<NcButton
 				variant="primary"
 				:href="mapsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<MapMarker :size="20" />
 				</template>
@@ -146,8 +145,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="pointUrl(point)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -188,7 +186,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnMapPoiCreate from '../../../components/CnMapPoiCreate/CnMapPoiCreate.vue'
 import CnMapPoiPicker from '../../../components/CnMapPoiPicker/CnMapPoiPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const COMMENT_MAX_CHARS = 160
@@ -389,8 +387,9 @@ export default {
 			return `${lat.toFixed(5)}, ${lng.toFixed(5)}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pointUrl(point) {
-			if (typeof point.url === 'string' && point.url !== '') {
+			if (typeof point.url === 'string' && point.url !== '' && safeHref(point.url) !== '#') {
 				return point.url
 			}
 			if (this.pointHasCoords(point)) {

package/src/integrations/builtin/maps/__tests__/CnMapsTab.spec.js

@@ -45,6 +45,15 @@ describe('CnMapsTab', () => {
 		delete global.fetch
 	})
 
+	it('links to the Maps app instead of a provider URL with an unsafe scheme', async () => {
+		global.fetch = jest.fn().mockResolvedValueOnce({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
+		const wrapper = mount(CnMapsTab, { propsData: { ...DEFAULT_PROPS } })
+		await flushPromises()
+		expect(wrapper.vm.pointUrl({ url: 'javascript:alert(1)' })).toBe('/index.php/apps/maps')
+		expect(wrapper.vm.pointUrl({ url: 'https://maps.example/p/1' })).toBe('https://maps.example/p/1')
+		wrapper.unmount()
+	})
+
 	it('renders the empty state with an "Open Locations" CTA when no points', async () => {
 		global.fetch = jest.fn().mockResolvedValueOnce({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
 		const wrapper = mount(CnMapsTab, { propsData: { ...DEFAULT_PROPS } })