feat: allow custom protocols for app href (#2575)

Co-authored-by: Manuel <30572287+manuel-rw@users.noreply.github.com> Co-authored-by: Meier Lukas <meierschlumpf@gmail.com>
2025-05-23 22:19:59 +02:00
parent 71516e02c0
commit 09af0a76f6
2 changed files with 27 additions and 1 deletions
--- a/packages/validation/src/app.ts
+++ b/packages/validation/src/app.ts
@@ -4,7 +4,7 @@ export const appHrefSchema = z
  .string()
  .trim()
  .url()
-  .regex(/^https?:\/\//) // Only allow http and https for security reasons (javascript: is not allowed)
+  .regex(/^(?!javascript)[a-zA-Z]*:\/\//i) // javascript: is not allowed, i for case insensitive (so Javascript: is also not allowed)
  .or(z.literal(""))
  .transform((value) => (value.length === 0 ? null : value))
  .nullable();