Restrict notification action links to application paths

webui/src/security/actionUrl.ts

@@ -0,0 +1,16 @@
+export function safeNotificationActionUrl(value: string | null | undefined): string | null {
+  const candidate = value?.trim();
+  if (
+    !candidate
+    || !candidate.startsWith("/")
+    || candidate.startsWith("//")
+    || candidate.includes("\\")
+    || [...candidate].some((character) => {
+      const codePoint = character.codePointAt(0) ?? 0;
+      return codePoint < 32 || codePoint === 127;
+    })
+  ) {
+    return null;
+  }
+  return candidate;
+}