feat: refactor copilot module (#14537)

blocksuite/affine/blocks/bookmark/src/bookmark-block.ts

@@ -108,7 +108,9 @@ export class BookmarkBlockComponent extends CaptionedBlockComponent<BookmarkBloc
   }
 
   open = () => {
-    window.open(this.link, '_blank');
+    const link = this.link;
+    if (!link) return;
+    window.open(link, '_blank', 'noopener,noreferrer');
   };
 
   refreshData = () => {

blocksuite/affine/components/src/link-preview/link.ts

@@ -1,4 +1,8 @@
-import { getHostName } from '@blocksuite/affine-shared/utils';
+import {
+  getHostName,
+  isValidUrl,
+  normalizeUrl,
+} from '@blocksuite/affine-shared/utils';
 import { PropTypes, requiredProperties } from '@blocksuite/std';
 import { css, LitElement } from 'lit';
 import { property } from 'lit/decorators.js';
@@ -44,15 +48,27 @@ export class LinkPreview extends LitElement {
 
   override render() {
     const { url } = this;
+    const normalizedUrl = normalizeUrl(url);
+    const safeUrl =
+      normalizedUrl && isValidUrl(normalizedUrl) ? normalizedUrl : null;
+    const hostName = getHostName(safeUrl ?? url);
+
+    if (!safeUrl) {
+      return html`
+        <span class="affine-link-preview">
+          <span>${hostName}</span>
+        </span>
+      `;
+    }
 
     return html`
       <a
         class="affine-link-preview"
         rel="noopener noreferrer"
         target="_blank"
-        href=${url}
+        href=${safeUrl}
       >
-        <span>${getHostName(url)}</span>
+        <span>${hostName}</span>
       </a>
     `;
   }

blocksuite/affine/inlines/footnote/src/footnote-node/footnote-node.ts

@@ -4,6 +4,7 @@ import type { FootNote } from '@blocksuite/affine-model';
 import { CitationProvider } from '@blocksuite/affine-shared/services';
 import { unsafeCSSVarV2 } from '@blocksuite/affine-shared/theme';
 import type { AffineTextAttributes } from '@blocksuite/affine-shared/types';
+import { isValidUrl, normalizeUrl } from '@blocksuite/affine-shared/utils';
 import { WithDisposable } from '@blocksuite/global/lit';
 import {
   BlockSelection,
@@ -152,7 +153,9 @@ export class AffineFootnoteNode extends WithDisposable(ShadowlessElement) {
   };
 
   private readonly _handleUrlReference = (url: string) => {
-    window.open(url, '_blank');
+    const normalizedUrl = normalizeUrl(url);
+    if (!normalizedUrl || !isValidUrl(normalizedUrl)) return;
+    window.open(normalizedUrl, '_blank', 'noopener,noreferrer');
   };
 
   private readonly _updateFootnoteAttributes = (footnote: FootNote) => {

blocksuite/affine/shared/src/utils/url.ts

@@ -24,6 +24,11 @@ const toURL = (str: string) => {
   }
 };
 
+const hasAllowedScheme = (url: URL) => {
+  const protocol = url.protocol.slice(0, -1).toLowerCase();
+  return ALLOWED_SCHEMES.has(protocol);
+};
+
 function resolveURL(str: string, baseUrl: string, padded = false) {
   const url = toURL(str);
   if (!url) return null;
@@ -61,6 +66,7 @@ export function normalizeUrl(str: string) {
 
   // Formatted
   if (url) {
+    if (!hasAllowedScheme(url)) return '';
     if (!str.endsWith('/') && url.href.endsWith('/')) {
       return url.href.substring(0, url.href.length - 1);
     }