197 files

custom_components/maintenance_supporter/frontend-src/components/storage-section-card.ts

@@ -7,10 +7,12 @@
  */
 
 import { LitElement, html, css, nothing } from "lit";
+import { docDisplayName } from "../helpers/document-categories";
 import { property, state } from "lit/decorators.js";
 import { t, ensureLocale, langOf } from "../styles";
 import { describeWsError } from "../ws-errors";
 import { openSignedDocument } from "../helpers/document-url";
+import { isSafeHttpUrl } from "../helpers/url";
 import { formatBytes } from "../helpers/format-bytes";
 import type { HomeAssistant } from "../types";
 
@@ -135,7 +137,10 @@ export class MaintenanceStorageSectionCard extends LitElement {
 
   private async _openResult(doc: SearchResult): Promise<void> {
     if (doc.kind === "weblink") {
-      window.open(doc.url, "_blank", "noopener");
+      // Defense-in-depth (mirrors task-documents/documents-section): never
+      // hand a non-http(s) weblink to window.open, even though the WS add
+      // path already rejects such schemes.
+      if (isSafeHttpUrl(doc.url)) window.open(doc.url, "_blank", "noopener");
       return;
     }
     try {
@@ -150,7 +155,7 @@ export class MaintenanceStorageSectionCard extends LitElement {
       <div class="obj-row result-row" title=${t("doc_open", L)} @click=${() => this._openResult(doc)}>
         <ha-icon icon=${doc.kind === "weblink" ? "mdi:link-variant" : "mdi:file-document-outline"}></ha-icon>
         <div class="result-info">
-          <div class="result-title">${doc.title || doc.filename || doc.url}</div>
+          <div class="result-title">${docDisplayName(doc)}</div>
           <div class="result-obj">${doc.object_name}</div>
         </div>
         <ha-icon class="result-open" icon=${doc.kind === "weblink" ? "mdi:open-in-new" : "mdi:eye-outline"}></ha-icon>