fix: Validate external URL schemes before opening

[charlesvien]

Problem

URLs were passed straight to the main openExternal handler with no scheme check, so a tampered value could launch file://, smb://, or custom app-handler schemes via shell.openExternal.

Changes

1. Add isSafeExternalUrl (http/https/mailto allowlist) to @posthog/shared
2. Reject disallowed schemes in the os.openExternal tRPC input
3. Short-circuit openUrlInBrowser on unsafe URLs so the window.open fallback can't bypass the guard
4. Add unit tests covering allowed and blocked schemes

How did you test this?

Manually

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[charlesvien]

• fix: Validate external URL schemes before opening #2494 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

T-Rex Logs

What T-Rex did

• Ran a focused 24-case URL safety test against the new safe external URL helper, covering uppercase and mixed-case schemes, malformed URLs, scheme-relative URLs, whitespace and control-character bypass attempts, unsafe schemes, and mailto query/header cases; confirmed unsafe URLs return before the tRPC call and the window.open fallback, and that the os.openExternal mutation has server-side input validation.
• Ran a 24-case Node.js test script exercising isSafeExternalUrl across bug classes; all 24 cases passed with exit code 0, and reviewed browser.ts guard logic and os.ts input validation to confirm defense-in-depth; notes indicate tests ran under Node.js due to ViTest incompatibilities.

Artifacts

24-case URL safety test output

• Evidence of the test results for the 24-case URL safety validation, used to inspect allowed and blocked URLs.

Generated URL validation edge-case test

• Source TypeScript test definitions used to generate the edge-case scenarios for the URL safety checks.

24-case URL safety test output: all pass

• Automated runtime results showing all 24 cases passed; validates isSafeExternalUrl behavior.

URL safety test script (TypeScript)

• Source TypeScript test script used to exercise isSafeExternalUrl across edge cases.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Validate external URL schemes before ope..." | Re-trigger Greptile}

[DanielVisca]

🔥