Skip to content

fix(security): restrict image element source URLs to HTTP and HTTPS protocols - #1018

Merged
d-oit merged 2 commits into
mainfrom
fix/security-image-url-protocol-validation-2533511425717203926
Oct 24, 2026
Merged

d-oit merged 2 commits into
mainfrom
fix/security-image-url-protocol-validation-2533511425717203926

Conversation

@d-oit

@d-oit d-oit commented Oct 24, 2026

Copy link
Copy Markdown
Owner

Restricts image URL protocol validation in markdown preview components (chat-subcomponents.tsx and editor-preview.tsx) to HTTP and HTTPS schemes via sanitizeUrl(src, ['http:', 'https:']). This prevents non-web or dangerous protocol schemes (such as mailto: or tel:) from being embedded as image element sources.


PR created automatically by Jules for task 2533511425717203926 started by @d-oit

@vercel

vercel Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
do-knowledge-studio Ready Ready Preview, v0 Oct 24, 2026 7:44pm UTC

@google-labs-jules

Copy link
Copy Markdown
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@github-actions github-actions Bot added config tests Related to automated/manual tests labels Oct 24, 2026
@github-actions

github-actions Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Blocked merge diagnosis — blocked
⏳ Check run(s) still in progress: ["Codacy Static Code Analysis","Stale Base Guard","Infrastructure as Code Security","Detect Changes","Secret Detection","Dependency Advisory Audit","Shell Script Security Analysis","Diagnose Blocked Merge State","Trivy Filesystem Security Scan","Analyze (actions)","Analyze (python)","Analyze (javascript-typescript)"]

@codacy-production

Copy link
Copy Markdown
Contributor

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 6 complexity · 2 duplication

Metric Results
Complexity 6
Duplication 2

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@d-oit
d-oit enabled auto-merge (squash) October 24, 2026 19:42
@d-oit
d-oit merged commit 6ed530a into main Oct 24, 2026
22 checks passed
@d-oit
d-oit deleted the fix/security-image-url-protocol-validation-2533511425717203926 branch October 24, 2026 19:44

This branch was successfully deployed

1 active deployment
Preview — 4cfc1071 Deployed Oct 24, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

config tests Related to automated/manual tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant