From 200bf4dfee0ae06910be004cf56fe53d47ca08bb Mon Sep 17 00:00:00 2001
From: Adil Shaikh <106678504+whoisasx@users.noreply.github.com>
Date: Thu, 14 May 2026 12:41:17 +0530
Subject: [PATCH] Potential fix for pull request finding 'CodeQL / Client-side
 cross-site scripting'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .../DashboardNotificationButton.tsx           | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/packages/web/src/components/DashboardNotificationButton.tsx b/packages/web/src/components/DashboardNotificationButton.tsx
index a3d897386..efc28ea23 100644
--- a/packages/web/src/components/DashboardNotificationButton.tsx
+++ b/packages/web/src/components/DashboardNotificationButton.tsx
@@ -59,16 +59,29 @@ function getSubjectPR(notification: DashboardNotificationRecord): Record<string,
   return subject ? recordField(subject, "pr") : null;
 }
 
+function sanitizeExternalUrl(value: string | null): string | null {
+  if (!value) return null;
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return parsed.toString();
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
 function getPRUrl(notification: DashboardNotificationRecord): string | null {
   const pr = getSubjectPR(notification);
-  return pr ? stringField(pr, "url") : null;
+  return sanitizeExternalUrl(pr ? stringField(pr, "url") : null);
 }
 
 function getReviewUrl(notification: DashboardNotificationRecord): string | null {
   const data = notificationDataV3(notification);
   if (!data) return null;
   const review = recordField(data, "review");
-  return review ? stringField(review, "url") : null;
+  return sanitizeExternalUrl(review ? stringField(review, "url") : null);
 }
 
 function normalizeActionText(value: string): string {
@@ -197,10 +210,13 @@ function NotificationItem({
   const successLabel = successNotificationLabel(notification);
   const label = successLabel ?? event.priority;
   const urlActions = (notification.actions ?? [])
-    .filter(
-      (action): action is { label: string; url: string } =>
-        typeof action.url === "string" && action.url.trim().length > 0,
-    )
+    .map((action) => {
+      const sanitizedUrl = sanitizeExternalUrl(
+        typeof action.url === "string" ? action.url.trim() : null,
+      );
+      return sanitizedUrl ? { label: action.label, url: sanitizedUrl } : null;
+    })
+    .filter((action): action is { label: string; url: string } => action !== null)
     .filter((action) => !shouldHideRedundantAction(action, { prUrl, reviewUrl }));
 
   return (