Skip to content

fix: reject scheme-only story URLs in feeds externalHref - #921

Open
devin-ai-integration[bot] wants to merge 3 commits into
devin/1792603540-react-foundationfrom
devin/1792606600-react-feeds-href-fix
Open

devin-ai-integration[bot] wants to merge 3 commits into
devin/1792603540-react-foundationfrom
devin/1792606600-react-feeds-href-fix

Conversation

@devin-ai-integration

@devin-ai-integration devin-ai-integration Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Summary

Follow-up to #918 for the Devin Review finding. In e49378c (#918) I changed externalHref to return the raw url instead of new URL(url).href. That reopened a gap: new URL('https:example.com') parses as https://example.com/, but the browser treats href="https:example.com" as relative on an https page and resolves it to /example.com, a route inside the app.

externalHref has since moved to shared/utils (eb20b9c) and item-details now uses it too, so after merging the base branch this fix covers feed titles and item-detail titles.

- url.indexOf('http') !== 0
+ !/^https?:\/\//.test(url)

Only absolute http(s):// URLs become external links now. Scheme-only forms such as https:example.com and http:/x fall back to the internal /item/:id link. Valid URLs are still returned unchanged, so the Angular parity from e49378c holds. Two test cases added; the full suite passes (220 tests).

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/cd07a47aec7c48daa5e331248f55d0bd
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/cd07a47aec7c48daa5e331248f55d0bd?variant=devin
Requested by: @ishita-cog


Devin Review

Status Commit
⚪ Not started —

Run Devin Review

Devin Review (Staging)


Devin Review

…ve as app routes

Co-Authored-By: Ishita Gupta <ishita.gupta@cognition.ai>
@devin-ai-integration

Copy link
Copy Markdown
Author

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

  • Disable automatic comment, CI, and merge conflict monitoring

…n' into devin/1792606600-react-feeds-href-fix
devin-ai-integration[bot]

This comment was marked as resolved.

…p' prefix check

Co-Authored-By: Ishita Gupta <ishita.gupta@cognition.ai>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants