Restrict markdown link navigation to safe URI schemes

[quintessence-proof]

File: src/ui/file-preview/src/markdown/linking.ts

Problem

isExternalHref() currently classifies anything with a scheme-like prefix as external:

// src/ui/file-preview/src/markdown/linking.ts  (current)
function isExternalHref(rawHref: string): boolean {
    return /^[A-Za-z][A-Za-z0-9+.-]*:/.test(rawHref) && !isWindowsAbsolutePath(rawHref);
}

This regex matches javascript:, data:, vbscript:, and file: as readily as
https:. A matched link is classified kind: 'external' and passed directly to
openExternalLink() or window.open() in controller.ts.

Browsers block javascript: in window.open() for now, but that is a downstream
assumption, not an explicit guarantee in this codebase. A small allowlist removes the
dependency on that external behaviour.

---

Patch

Replace the existing isExternalHref with the version below, or add the scheme check
as a guard directly in resolveMarkdownLink before the kind: 'external' return.

// ── Safe-scheme allowlist ─────────────────────────────────────────────────────

/** Schemes that are permitted to open as external links. */
const ALLOWED_EXTERNAL_SCHEMES = new Set([
    'http',
    'https',
    'mailto',
    'ftp',    // keep for completeness; rare in practice
]);

/**
 * Returns true only for URLs with a scheme we explicitly permit.
 * Prevents javascript:, data:, vbscript:, file:, blob: etc. from being
 * treated as navigable external links.
 */
function isExternalHref(rawHref: string): boolean {
    if (isWindowsAbsolutePath(rawHref)) return false;

    const match = rawHref.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
    if (!match) return false;

    return ALLOWED_EXTERNAL_SCHEMES.has(match[1].toLowerCase());
}

No other changes are needed — resolveMarkdownLink already uses isExternalHref as
its gate, and anything that doesn't match external, anchor, or a Windows absolute
path falls through to the file classification (which is safe — it opens a local file
via the host's file-read tools).

---

What changes for users

Links using javascript:, data:, file:, blob:, or any other non-listed scheme
will no longer trigger navigation. They silently become no-ops on click.
http:, https:, and mailto: links are unaffected.

Add to ALLOWED_EXTERNAL_SCHEMES if additional schemes need to be navigable.

---

Test cases

// Should classify as external (allowed):
isExternalHref('https://example.com')   // true
isExternalHref('http://example.com')    // true
isExternalHref('mailto:a@b.com')        // true

// Should NOT classify as external (blocked):
isExternalHref('javascript:alert(1)')   // false
isExternalHref('data:text/html,<h1>x</h1>') // false
isExternalHref('vbscript:msgbox(1)')    // false
isExternalHref('file:///etc/passwd')    // false
isExternalHref('blob:https://…')        // false
isExternalHref('/relative/path')        // false (no scheme)
isExternalHref('#anchor')               // false (no scheme)

[cschanhniem]

The javascript: scheme bypass here is a good catch, but the deeper pattern across this repo's open issues is worth naming: an MCP server is an extension of the AI agent's trust boundary, and every allow-scripts sandbox, every PATH-resolved spawn, and every unrestricted markdown link is an attack surface that a coding agent can be tricked into traversing.

Looking at this repo's open security issues together:

• Restrict markdown link navigation to safe URI schemes #508 — URI scheme restriction (this one)
• Add Content-Security-Policy to the HTML-preview iframe #507 — CSP for HTML preview iframe
• Resolve spawned executables by absolute path #509 — Absolute path resolution for spawned executables
• MS Defender flags as remote shell #511 — MS Defender flagging as remote shell

These aren't independent bugs. They're artifacts of the same architectural choice: the MCP server grants the LLM direct access to OS primitives (shell, filesystem, network) with no policy gate between "model generates tool call" and "tool executes."

AGENTOWNERS (https://github.com/agentcontrol/agentowners) addresses this at the policy layer — a deterministic AGENTOWNERS.yml file that defines what an AI agent may access before the MCP tool ever fires:

rules:
  - decision: block
    agent_type: ai_agent
    action: webfetch
    glob: "localhost:*,127.0.0.1:*,::1:*"
    note: "No internal service access from AI agents"
  
  - decision: require_approval
    agent_type: ai_agent
    action: shell_exec
    pattern: "curl|wget|nc|ssh|scp"
    note: "Network exfiltration tools need human approval"

For DesktopCommander specifically, the cleanest integration point would be a policy check in scriptExecutor.terminalSession.send() — between the agent's tool call resolution and the PTY write. If AGENTOWNERS says block on a network-exfiltrating shell command, it never reaches the terminal.

The URI scheme fix here is correct (allowlist > regex), but the durable solution is recognizing that markdown link navigation from agent-generated content is itself a policy question: should agents be able to open arbitrary URLs on the user's machine at all?