Restrict notification action links to application paths

webui/src/features/notifications/NotificationCenterPage.tsx

@@ -2,6 +2,7 @@ import { useEffect, useMemo, useState } from "react";
 import { Bell, Check, ExternalLink, RefreshCw, Send, XCircle } from "lucide-react";
 import { Button, DismissibleAlert, hasScope, type ApiSettings, type AuthInfo } from "@govoplan/core-webui";
 import { deliverPendingNotifications, listNotifications, updateNotification, type NotificationMessage } from "../../api/notifications";
+import { safeNotificationActionUrl } from "../../security/actionUrl";
 
 type StatusFilter = "all" | "pending" | "queued" | "sent" | "failed" | "skipped" | "cancelled";
 
@@ -171,6 +172,7 @@ export default function NotificationCenterPage({ settings, auth }: { settings: A
 }
 
 function NotificationDetails({ notification }: { notification: NotificationMessage }) {
+  const actionUrl = safeNotificationActionUrl(notification.action_url);
   return (
     <div className="notifications-detail">
       <section className="notifications-message">
@@ -181,8 +183,8 @@ function NotificationDetails({ notification }: { notification: NotificationMessa
         </div>
         <h1>{notification.subject || notification.event_kind}</h1>
         {notification.body_text ? <p>{notification.body_text}</p> : <p className="muted">No message body was provided.</p>}
-        {notification.action_url ? (
-          <a className="notifications-action-link" href={notification.action_url}>
+        {actionUrl ? (
+          <a className="notifications-action-link" href={actionUrl}>
             <ExternalLink size={16} /> Open related item
           </a>
         ) : null}