fix(docs): constrain user runtime links

2026-07-21 18:43:48 +02:00
parent a08bc7c204
commit 2f912ff619
2 changed files with 5 additions and 1 deletions
--- a/src/govoplan_docs/backend/api/v1/routes.py
+++ b/src/govoplan_docs/backend/api/v1/routes.py
@@ -681,7 +681,10 @@ def _bounded_string_list(value: object, *, maximum_items: int, maximum_length: i
 def _user_link_allowed(link: DocumentationLink) -> bool:
    href = link.href.strip()
    if link.kind == "runtime":
-        return href.startswith("/") and not href.startswith("//")
+        if not href.startswith("/") or href.startswith("//") or "\\" in href:
+            return False
+        parsed = urlsplit(href)
+        return not parsed.scheme and not parsed.netloc
    if link.kind != "public":
        return False
    parsed = urlsplit(href)