Kevin Veen-Birkenbach 7353e8d96a fix(iframe): hand the sinks the validated URL, not the parameter ...

The scheme and origin checks lived in a boolean guard in another function, so the raw query parameter still reached the iframe src, the history entry and window.open. The validator now returns the normalised href or null, and every sink consumes only that. Which URLs are accepted does not change: openIframe still checks the scheme alone, because the modal opens configured targets that are not among the page's iframe links.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-23 02:10:05 +02:00

2.3 KiB

Raw Blame History

View Raw