From 147dc9d4da25707217bc22a27a4c2f19274ca03c Mon Sep 17 00:00:00 2001
From: Nicolas Werner <nicolas.werner@hotmail.de>
Date: Sun, 17 Oct 2021 17:18:02 +0200
Subject: [PATCH] Use allow list for URI schemes

---
 src/ui/NhekoGlobalObject.cpp | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/ui/NhekoGlobalObject.cpp b/src/ui/NhekoGlobalObject.cpp
index 15f2a5af..a93466d2 100644
--- a/src/ui/NhekoGlobalObject.cpp
+++ b/src/ui/NhekoGlobalObject.cpp
@@ -61,7 +61,17 @@ Nheko::openLink(QString link) const
     QUrl url(link);
     // Open externally if we couldn't handle it internally
     if (!ChatPage::instance()->handleMatrixUri(url)) {
-        QDesktopServices::openUrl(url);
+        const QStringList allowedUrlSchemes = {
+          "http",
+          "https",
+          "mailto",
+        };
+
+        if (allowedUrlSchemes.contains(url.scheme()))
+            QDesktopServices::openUrl(url);
+        else
+            nhlog::ui()->warn("Url '{}' not opened, because the scheme is not in the allow list",
+                              url.toDisplayString().toStdString());
     }
 }
 void