From 8636d0f82014b2107281de9d2e7d2827f58e3921 Mon Sep 17 00:00:00 2001
From: RyotaK <49341894+Ry0taK@users.noreply.github.com>
Date: Sat, 17 Dec 2022 01:31:11 +0900
Subject: [PATCH 1/5] Add allowNonHttpProtocols to typings

---
 typings/xterm.d.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/typings/xterm.d.ts b/typings/xterm.d.ts
index b652491a..836299de 100644
--- a/typings/xterm.d.ts
+++ b/typings/xterm.d.ts
@@ -1179,6 +1179,13 @@ declare module 'xterm' {
       * @param range The buffer range of the link.
       */
      leave?(event: MouseEvent, text: string, range: IBufferRange): void;
+    
+     /**
+      * Whether to allow the use of non HTTP URLs in OscLinkProvider. When false, any usage of non
+      * HTTP URLs will be ignored. Enabling this option without proper protection in activate function
+      * may allow XSS.
+      */
+     allowNonHttpProtocols?: boolean;
   }
 
   /**

From cb8d93a1ef137a0a7a8d193e431091ec216b91ea Mon Sep 17 00:00:00 2001
From: RyotaK <49341894+Ry0taK@users.noreply.github.com>
Date: Fri, 16 Dec 2022 16:50:57 +0000
Subject: [PATCH 2/5] Implement protocol validation

---
 src/browser/OscLinkProvider.ts | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/src/browser/OscLinkProvider.ts b/src/browser/OscLinkProvider.ts
index c621ddf2..1b6ee483 100644
--- a/src/browser/OscLinkProvider.ts
+++ b/src/browser/OscLinkProvider.ts
@@ -66,14 +66,25 @@ export class OscLinkProvider implements ILinkProvider {
               y
             }
           };
-          // OSC links always use underline and pointer decorations
-          result.push({
-            text,
-            range,
-            activate: (e, text) => (linkHandler ? linkHandler.activate(e, text, range) : defaultActivate(e, text)),
-            hover: (e, text) => linkHandler?.hover?.(e, text, range),
-            leave: (e, text) => linkHandler?.leave?.(e, text, range)
-          });
+
+          let ignoreLink = false;
+          if (!linkHandler?.allowNonHttpProtocols) {
+            const parsed = new URL(text);
+            if (!['http:', 'https:'].includes(parsed.protocol)) {
+              ignoreLink = true;
+            }
+          }
+
+          if (!ignoreLink) {
+            // OSC links always use underline and pointer decorations
+            result.push({
+              text,
+              range,
+              activate: (e, text) => (linkHandler ? linkHandler.activate(e, text, range) : defaultActivate(e, text)),
+              hover: (e, text) => linkHandler?.hover?.(e, text, range),
+              leave: (e, text) => linkHandler?.leave?.(e, text, range)
+            });
+          }
         }
         finishLink = false;
 

From e4b473785d77779313471f10f3dd5c5e86dcf68e Mon Sep 17 00:00:00 2001
From: RyotaK <49341894+Ry0taK@users.noreply.github.com>
Date: Fri, 16 Dec 2022 16:54:27 +0000
Subject: [PATCH 3/5] Make comment more clear

---
 typings/xterm.d.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/typings/xterm.d.ts b/typings/xterm.d.ts
index 836299de..a7c197e1 100644
--- a/typings/xterm.d.ts
+++ b/typings/xterm.d.ts
@@ -1181,9 +1181,9 @@ declare module 'xterm' {
      leave?(event: MouseEvent, text: string, range: IBufferRange): void;
     
      /**
-      * Whether to allow the use of non HTTP URLs in OscLinkProvider. When false, any usage of non
-      * HTTP URLs will be ignored. Enabling this option without proper protection in activate function
-      * may allow XSS.
+      * Whether to receive non HTTP URLs from LinkProvider. When false, any usage of non HTTP URLs
+      * will be ignored. Enabling this option without proper protection in `activate` function
+      * may cause security issues such as XSS.
       */
      allowNonHttpProtocols?: boolean;
   }

From b07c016fea1a8449abc473bddfe2f300f4f902bb Mon Sep 17 00:00:00 2001
From: RyotaK <49341894+Ry0taK@users.noreply.github.com>
Date: Fri, 16 Dec 2022 16:58:35 +0000
Subject: [PATCH 4/5] Adjust the comment

---
 typings/xterm.d.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/typings/xterm.d.ts b/typings/xterm.d.ts
index a7c197e1..dc7c38b2 100644
--- a/typings/xterm.d.ts
+++ b/typings/xterm.d.ts
@@ -1181,7 +1181,7 @@ declare module 'xterm' {
      leave?(event: MouseEvent, text: string, range: IBufferRange): void;
     
      /**
-      * Whether to receive non HTTP URLs from LinkProvider. When false, any usage of non HTTP URLs
+      * Whether to receive non-HTTP URLs from LinkProvider. When false, any usage of non-HTTP URLs
       * will be ignored. Enabling this option without proper protection in `activate` function
       * may cause security issues such as XSS.
       */

From b3d36478ca52763cbcff24f457001894b9be2841 Mon Sep 17 00:00:00 2001
From: RyotaK <49341894+Ry0taK@users.noreply.github.com>
Date: Fri, 16 Dec 2022 17:01:00 +0000
Subject: [PATCH 5/5] Properly handle errors from URL constructor

---
 src/browser/OscLinkProvider.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/browser/OscLinkProvider.ts b/src/browser/OscLinkProvider.ts
index 1b6ee483..648ffa44 100644
--- a/src/browser/OscLinkProvider.ts
+++ b/src/browser/OscLinkProvider.ts
@@ -69,8 +69,13 @@ export class OscLinkProvider implements ILinkProvider {
 
           let ignoreLink = false;
           if (!linkHandler?.allowNonHttpProtocols) {
-            const parsed = new URL(text);
-            if (!['http:', 'https:'].includes(parsed.protocol)) {
+            try {
+              const parsed = new URL(text);
+              if (!['http:', 'https:'].includes(parsed.protocol)) {
+                ignoreLink = true;
+              }
+            } catch (e) {
+              // Ignore invalid URLs to prevent unexpected behaviors
               ignoreLink = true;
             }
           }