search

element-hq / element-x-android

Android Matrix messenger application using the Matrix Rust Sdk and Jetpack Compose
GNU Affero General Public License v3.0
966 stars 129 forks source link

Warn if link text doesn't match link target #2861

Open bmarty opened 3 months ago

bmarty commented 3 months ago

Steps to reproduce

  1. Send a link with a different target, like for instance [https://example.org](https://evil.org/)
  2. User will think is is opening https://example.org, but the device will open https://evil.org/

Outcome

What did you expect?

A dialog should be displayed to warn the user about the host not matching

What happened instead?

https://evil.org/ is opened without any warning.

Element Android similar issue: https://github.com/element-hq/element-android/issues/922

Your phone model

No response

Operating system version

No response

Application version and app store

No response

Homeserver

No response

Will you send logs?

No

Are you willing to provide a PR?

No

bmarty commented 3 months ago

Actually, it seems that EXA is opening https://example.org/, which is a bug to also fix, but which is mitigating the problem.

A regular markdown link (for instance [test](https://matrix.org/)), is rendered like this:

image

When the text is also a link, this is rendered like this, so there is some of inconsistency in link rendering.

image