updated apps

custom_components/maintenance_supporter/frontend-src/helpers/url.ts

@@ -0,0 +1,11 @@
+/** Shared URL-safety guard for rendering user-supplied links.
+ *
+ * A user-entered URL (object/task documentation, spare-part shopping link,
+ * document weblink) must only ever be linkified when it is an absolute http(s)
+ * URL — never `javascript:`/`data:`/protocol-relative — else it is a stored-XSS
+ * vector. The `X && /^https?:\/\//i.test(X)` idiom was inlined at ~8 render
+ * sites; one forgotten copy is a hole, so it lives here once.
+ */
+export function isSafeHttpUrl(url: string | null | undefined): url is string {
+  return !!url && /^https?:\/\//i.test(url);
+}