From b6f9679985b2a910038ce123a5ed3af2a6f7d207 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Sun, 27 Sep 2026 23:52:15 +0200
Subject: [PATCH] refac: only open web, mail, phone and relative file links
 (#31491)

File attachment links and the file links in code execution results now go through the same link check as links in chat messages, so only web, mail, phone and relative links are opened.
---
 src/lib/components/chat/Messages/CodeExecutionModal.svelte | 3 ++-
 src/lib/components/common/FileItem.svelte                  | 4 ++--
 src/lib/components/common/FileItemModal.svelte             | 4 ++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/lib/components/chat/Messages/CodeExecutionModal.svelte b/src/lib/components/chat/Messages/CodeExecutionModal.svelte
index 4b4ee0b7a7..fd33b7dd23 100644
--- a/src/lib/components/chat/Messages/CodeExecutionModal.svelte
+++ b/src/lib/components/chat/Messages/CodeExecutionModal.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { getContext } from 'svelte';
+	import { safeLinkUrl } from '$lib/utils';
 	import CodeBlock from './CodeBlock.svelte';
 	import Modal from '$lib/components/common/Modal.svelte';
 	import Spinner from '$lib/components/common/Spinner.svelte';
@@ -97,7 +98,7 @@
 						<ul class="mt-1 list-disc pl-4 text-xs">
 							{#each codeExecution?.result?.files as file}
 								<li>
-									<a href={file.url} target="_blank">{file.name}</a>
+									<a href={safeLinkUrl(file.url)} target="_blank">{file.name}</a>
 								</li>
 							{/each}
 						</ul>
diff --git a/src/lib/components/common/FileItem.svelte b/src/lib/components/common/FileItem.svelte
index cf1695018c..1172f05c42 100644
--- a/src/lib/components/common/FileItem.svelte
+++ b/src/lib/components/common/FileItem.svelte
@@ -2,7 +2,7 @@
 	import { createEventDispatcher, getContext } from 'svelte';
 	import { WEBUI_API_BASE_URL } from '$lib/constants';
 
-	import { formatFileSize } from '$lib/utils';
+	import { formatFileSize, safeLinkUrl } from '$lib/utils';
 	import { settings, showFileNavPath } from '$lib/stores';
 
 	import FileItemModal from './FileItemModal.svelte';
@@ -71,7 +71,7 @@
 					} else {
 						window.open(`${WEBUI_API_BASE_URL}/files/${url}/content`, '_blank').focus();
 					}
-				} else {
+				} else if (safeLinkUrl(url)) {
 					window.open(`${url}`, '_blank').focus();
 				}
 			}
diff --git a/src/lib/components/common/FileItemModal.svelte b/src/lib/components/common/FileItemModal.svelte
index f17b70d329..a19e5246d5 100644
--- a/src/lib/components/common/FileItemModal.svelte
+++ b/src/lib/components/common/FileItemModal.svelte
@@ -4,7 +4,7 @@
 
 	import { getContext, onMount, tick } from 'svelte';
 
-	import { formatFileSize, getLineCount } from '$lib/utils';
+	import { formatFileSize, getLineCount, safeLinkUrl } from '$lib/utils';
 	import { WEBUI_API_BASE_URL } from '$lib/constants';
 	import { settings } from '$lib/stores';
 	import { getKnowledgeById } from '$lib/apis/knowledge';
@@ -264,7 +264,7 @@
 							href="#"
 							class="hover:underline line-clamp-1"
 							on:click|preventDefault={() => {
-								if (item.type === 'file' || item.url) {
+								if (item.type === 'file' || safeLinkUrl(item.url)) {
 									let fileId = item?.id ?? item?.tempId;
 									window.open(
 										item.type === 'file'