@luigi-project/core-modular 0.0.20-dev.202610280038 → 0.0.20-dev.202610291610

package/luigi.js

@@ -7103,6 +7103,21 @@ var ui = {
 	sanitizeParam(e = "") {
 		return String(e).replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\//g, "&sol;");
 	},
+	sanitizeExternalNavigationUrl(e = "") {
+		try {
+			let t = "https://sentinel.invalid", n = new URL(e, t);
+			if (!["http:", "https:"].includes(n.protocol)) return;
+			let r = n.origin === t, i = n.pathname;
+			if (i === "/") {
+				let t = String(e);
+				(r ? t : t.slice((n.protocol + "//" + n.host).length)).startsWith("/") || (i = "");
+			}
+			return r ? i + n.search + n.hash : n.protocol + "//" + n.host + i + n.search + n.hash;
+		} catch {
+			console.warn(`Blocked unsafe external navigation URL: ${e}`);
+			return;
+		}
+	},
 	escapeKeyForRegexp(e = "") {
 		return e.replace(/[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g, "\\$&");
 	},
@@ -7274,10 +7289,14 @@ var ui = {
 	},
 	openExternalLink(e, t) {
 		let n = e.url;
-		if (t && (n = a.replaceVars(n, t, ":", !1)), e.sameWindow) window.location.href = n;
-		else {
-			let e = window.open(n, "_blank", "noopener noreferrer");
-			e && (e.opener = null, e.focus());
+		t && (n = a.replaceVars(n, t, ":", !1));
+		let r = ui.sanitizeExternalNavigationUrl(n);
+		if (r) {
+			if (e.sameWindow) window.location.href = r;
+			else {
+				let e = window.open(r, "_blank", "noopener noreferrer");
+				e && (e.opener = null, e.focus());
+			}
 		}
 	}
 }, U = {