197 files

custom_components/maintenance_supporter/frontend-src/components/task-documents.ts

@@ -15,8 +15,9 @@ import { t, ensureLocale, langOf } from "../styles";
 import { describeWsError } from "../ws-errors";
 import { downloadUrl } from "../helpers/download";
 import { downloadSignedDocument, openSignedDocument } from "../helpers/document-url";
+import { isSafeHttpUrl } from "../helpers/url";
 import { formatBytes } from "../helpers/format-bytes";
-import { CATEGORIES, CATEGORY_ICONS } from "../helpers/document-categories";
+import { docDisplayName, CATEGORIES, CATEGORY_ICONS } from "../helpers/document-categories";
 import type { HomeAssistant } from "../types";
 
 interface Doc {
@@ -144,7 +145,11 @@ export class MaintenanceTaskDocuments extends LitElement {
 
   private async _open(doc: Doc): Promise<void> {
     if (doc.kind === "weblink") {
-      window.open(doc.url, "_blank", "noopener");
+      // Defense-in-depth: the add-link WS path already refuses non-http(s)
+      // schemes, but a weblink stored before that check (or via a future
+      // path) must never reach window.open as javascript:/data: — guard the
+      // sink too, like documents-section does.
+      if (isSafeHttpUrl(doc.url)) window.open(doc.url, "_blank", "noopener");
       return;
     }
     // A per-task page hint jumps straight to the relevant page via the PDF
@@ -206,7 +211,7 @@ export class MaintenanceTaskDocuments extends LitElement {
               >
                 <option value="" ?selected=${!this._attachId}>${t("doc_link_existing", L)}</option>
                 ${available.map(
-                  (d) => html`<option value=${d.id} ?selected=${d.id === this._attachId}>${d.title || d.filename || d.url}</option>`,
+                  (d) => html`<option value=${d.id} ?selected=${d.id === this._attachId}>${docDisplayName(d)}</option>`,
                 )}
               </select>
               <button class="tdoc-btn" ?disabled=${this._busy || !this._attachId} @click=${this._link}>
@@ -240,7 +245,7 @@ export class MaintenanceTaskDocuments extends LitElement {
             }
           }}
         >
-          <div class="tdoc-title">${doc.title || doc.filename || doc.url}</div>
+          <div class="tdoc-title">${docDisplayName(doc)}</div>
           <div class="tdoc-meta">
             ${meta}${page ? html` · <span class="tdoc-pagetag">${t("doc_page", L)} ${page}</span>` : nothing}
           </div>