fix: block unsafe editor links

src/components/useEditorLinkActivation.test.tsx

@@ -46,13 +46,20 @@ function appendUrl(container: HTMLElement, href: string) {
   const link = document.createElement('a')
   link.setAttribute('href', href)
   link.textContent = href
-  link.addEventListener('click', (event) => {
-    if (!(event as MouseEvent).metaKey) event.preventDefault()
-  })
   container.appendChild(link)
   return link
 }
 
+function dispatchClick(target: HTMLElement, options: MouseEventInit = {}) {
+  const event = new MouseEvent('click', {
+    bubbles: true,
+    cancelable: true,
+    ...options,
+  })
+  target.dispatchEvent(event)
+  return event
+}
+
 describe('useEditorLinkActivation', () => {
   beforeEach(() => {
     mockOpenExternalUrl.mockClear()
@@ -86,11 +93,25 @@ describe('useEditorLinkActivation', () => {
     const { container } = renderHarness()
     const link = appendUrl(container, 'https://example.com')
 
-    fireEvent.click(link)
+    const plainClick = dispatchClick(link)
     expect(mockOpenExternalUrl).not.toHaveBeenCalled()
+    expect(plainClick.defaultPrevented).toBe(true)
 
-    fireEvent.click(link, { metaKey: true })
+    const modifiedClick = dispatchClick(link, { metaKey: true })
     expect(mockOpenExternalUrl).toHaveBeenCalledWith('https://example.com')
+    expect(modifiedClick.defaultPrevented).toBe(true)
+  })
+
+  it('blocks malformed URL anchors instead of opening or falling through', () => {
+    const { container } = renderHarness()
+    const link = appendUrl(container, 'https://exa mple.com')
+
+    const plainClick = dispatchClick(link)
+    const modifiedClick = dispatchClick(link, { metaKey: true })
+
+    expect(plainClick.defaultPrevented).toBe(true)
+    expect(modifiedClick.defaultPrevented).toBe(true)
+    expect(mockOpenExternalUrl).not.toHaveBeenCalled()
   })
 
   it('ignores malformed URLs and links inside code blocks', () => {

src/components/useEditorLinkActivation.ts

@@ -1,5 +1,5 @@
 import { useEffect, type RefObject } from 'react'
-import { isUrlValue, normalizeUrl, openExternalUrl } from '../utils/url'
+import { normalizeExternalUrl, openExternalUrl } from '../utils/url'
 
 const CODE_CONTEXT_SELECTOR = '[data-content-type="codeBlock"], pre, code'
 
@@ -15,10 +15,8 @@ function resolveWikilinkTarget(target: HTMLElement) {
   return target.closest<HTMLElement>('.wikilink[data-target]')?.dataset.target ?? null
 }
 
-function resolveUrlTarget(target: HTMLElement) {
-  const href = target.closest<HTMLAnchorElement>('a[href]')?.getAttribute('href')?.trim()
-  if (!href || !isUrlValue(href)) return null
-  return normalizeUrl(href)
+function resolveAnchorHref(target: HTMLElement) {
+  return target.closest<HTMLAnchorElement>('a[href]')?.getAttribute('href')?.trim() ?? null
 }
 
 function blurActiveEditable(container: HTMLElement) {
@@ -33,6 +31,52 @@ function setFollowLinksActive(container: HTMLElement, active: boolean) {
   else container.removeAttribute('data-follow-links')
 }
 
+function consumeEditorLinkClick(event: MouseEvent) {
+  event.preventDefault()
+  event.stopPropagation()
+}
+
+function activateWikilink(
+  event: MouseEvent,
+  container: HTMLElement,
+  target: string,
+  onNavigateWikilink: (target: string) => void,
+) {
+  if (!hasFollowModifier(event)) return
+
+  consumeEditorLinkClick(event)
+  blurActiveEditable(container)
+  onNavigateWikilink(target)
+}
+
+function activateExternalUrl(event: MouseEvent, href: string) {
+  consumeEditorLinkClick(event)
+
+  if (!hasFollowModifier(event)) return
+
+  const urlTarget = normalizeExternalUrl(href)
+  if (!urlTarget) return
+
+  openExternalUrl(urlTarget).catch((err) => console.warn('[link] Failed to open URL:', err))
+}
+
+function handleEditorLinkClick(
+  event: MouseEvent,
+  container: HTMLElement,
+  onNavigateWikilink: (target: string) => void,
+) {
+  if (!(event.target instanceof HTMLElement) || isInsideCodeContext(event.target)) return
+
+  const wikilinkTarget = resolveWikilinkTarget(event.target)
+  if (wikilinkTarget) {
+    activateWikilink(event, container, wikilinkTarget, onNavigateWikilink)
+    return
+  }
+
+  const href = resolveAnchorHref(event.target)
+  if (href) activateExternalUrl(event, href)
+}
+
 export function useEditorLinkActivation(
   containerRef: RefObject<HTMLDivElement | null>,
   onNavigateWikilink: (target: string) => void,
@@ -49,24 +93,7 @@ export function useEditorLinkActivation(
       if (document.visibilityState !== 'visible') resetModifierState()
     }
     const handleClick = (event: MouseEvent) => {
-      if (!hasFollowModifier(event)) return
-      if (!(event.target instanceof HTMLElement) || isInsideCodeContext(event.target)) return
-
-      const wikilinkTarget = resolveWikilinkTarget(event.target)
-      if (wikilinkTarget) {
-        event.preventDefault()
-        event.stopPropagation()
-        blurActiveEditable(container)
-        onNavigateWikilink(wikilinkTarget)
-        return
-      }
-
-      const urlTarget = resolveUrlTarget(event.target)
-      if (!urlTarget) return
-
-      event.preventDefault()
-      event.stopPropagation()
-      openExternalUrl(urlTarget).catch((err) => console.warn('[link] Failed to open URL:', err))
+      handleEditorLinkClick(event, container, onNavigateWikilink)
     }
 
     container.addEventListener('click', handleClick, true)