Restrict notification action links to application paths

webui/tests/action-url.test.ts

@@ -0,0 +1,27 @@
+import { safeNotificationActionUrl } from "../src/security/actionUrl";
+
+function assertEqual(actual: unknown, expected: unknown, message: string): void {
+  if (actual !== expected) {
+    throw new Error(`${message}: expected ${String(expected)}, got ${String(actual)}`);
+  }
+}
+
+assertEqual(
+  safeNotificationActionUrl(" /calendar?event=event-1#details "),
+  "/calendar?event=event-1#details",
+  "application-relative links remain available"
+);
+
+for (const unsafe of [
+  "javascript:alert(1)",
+  "data:text/html,unsafe",
+  "https://attacker.example.test/collect",
+  "//attacker.example.test/collect",
+  "/\\attacker.example.test/collect",
+  "/calendar\nmalformed",
+  "/calendar\u007fmalformed"
+]) {
+  assertEqual(safeNotificationActionUrl(unsafe), null, `unsafe link is suppressed: ${unsafe}`);
+}
+
+assertEqual(safeNotificationActionUrl(null), null, "missing links remain absent");