Classic phishing shape: <a href="https://evil.example/login">https://matrix.lotusguild.org/login</a>. The timeline renders the visible text; the click goes elsewhere.
Scope
At render (react-custom-html-parser <a> branch): if the anchor's visible text parses as a URL (or looks like a hostname) and its origin differs from href's origin, mark the anchor. On click: intercept and show a small confirm — "This link shows matrix.lotusguild.org but goes to evil.example. Open anyway?" — with Open / Cancel. No confirm for honest links; no setting.
Also cover the "IDN homograph" case cheaply: if href hostname contains non-ASCII / punycode (xn--), show the punycode form in the confirm.
Exempt: matrix.to / permalinks, mailto:, links whose text is a shortened form of the same origin (e.g. text youtube.com/… for a www.youtube.com href — compare registrable domain, not full host).
Unit tests on the "text vs href" comparator (utils/linkSafety.ts).
Classic phishing shape: `<a href="https://evil.example/login">https://matrix.lotusguild.org/login</a>`. The timeline renders the visible text; the click goes elsewhere.
### Scope
- At render (react-custom-html-parser `<a>` branch): if the anchor's visible text parses as a URL (or looks like a hostname) and its origin differs from `href`'s origin, mark the anchor. On click: intercept and show a small confirm — "This link shows **matrix.lotusguild.org** but goes to **evil.example**. Open anyway?" — with *Open* / *Cancel*. No confirm for honest links; no setting.
- Also cover the "IDN homograph" case cheaply: if `href` hostname contains non-ASCII / punycode (`xn--`), show the punycode form in the confirm.
- Exempt: matrix.to / permalinks, `mailto:`, links whose text is a *shortened* form of the same origin (e.g. text `youtube.com/…` for a `www.youtube.com` href — compare registrable domain, not full host).
- Unit tests on the "text vs href" comparator (`utils/linkSafety.ts`).
Done in 74d8e311. utils/linkSafety.ts compares the registrable domain the visible text claims (when it looks like a URL/host) with the href's; a mismatch, or a punycode (IDN) destination, renders the anchor as SuspiciousLink, whose click opens a confirm — "It shows matrix.lotusguild.org but goes to evil.example." with the full URL, Cancel / Open anyway (new tab, noopener). Honest links are untouched: same registrable domain (youtube.com text over www.youtube.com, bbc.co.uk over news.bbc.co.uk), plain-word text, mailto:, matrix.to and Lotus permalinks, anchors with non-text children. Comparator unit-tested (incl. a Cyrillic-а paypal homograph). Verified headless: the phish and IDN messages are flagged, the honest ones are not, click shows the confirm and does not navigate, Cancel stays, Open anyway opens the real target.
Done in `74d8e311`. `utils/linkSafety.ts` compares the registrable domain the visible text claims (when it looks like a URL/host) with the href's; a mismatch, or a punycode (IDN) destination, renders the anchor as `SuspiciousLink`, whose click opens a confirm — "It shows **matrix.lotusguild.org** but goes to **evil.example**." with the full URL, *Cancel* / *Open anyway* (new tab, noopener). Honest links are untouched: same registrable domain (`youtube.com` text over `www.youtube.com`, `bbc.co.uk` over `news.bbc.co.uk`), plain-word text, `mailto:`, matrix.to and Lotus permalinks, anchors with non-text children. Comparator unit-tested (incl. a Cyrillic-а paypal homograph). Verified headless: the phish and IDN messages are flagged, the honest ones are not, click shows the confirm and does not navigate, Cancel stays, Open anyway opens the real target.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Classic phishing shape:
<a href="https://evil.example/login">https://matrix.lotusguild.org/login</a>. The timeline renders the visible text; the click goes elsewhere.Scope
<a>branch): if the anchor's visible text parses as a URL (or looks like a hostname) and its origin differs fromhref's origin, mark the anchor. On click: intercept and show a small confirm — "This link shows matrix.lotusguild.org but goes to evil.example. Open anyway?" — with Open / Cancel. No confirm for honest links; no setting.hrefhostname contains non-ASCII / punycode (xn--), show the punycode form in the confirm.mailto:, links whose text is a shortened form of the same origin (e.g. textyoutube.com/…for awww.youtube.comhref — compare registrable domain, not full host).utils/linkSafety.ts).Done in
74d8e311.utils/linkSafety.tscompares the registrable domain the visible text claims (when it looks like a URL/host) with the href's; a mismatch, or a punycode (IDN) destination, renders the anchor asSuspiciousLink, whose click opens a confirm — "It shows matrix.lotusguild.org but goes to evil.example." with the full URL, Cancel / Open anyway (new tab, noopener). Honest links are untouched: same registrable domain (youtube.comtext overwww.youtube.com,bbc.co.ukovernews.bbc.co.uk), plain-word text,mailto:, matrix.to and Lotus permalinks, anchors with non-text children. Comparator unit-tested (incl. a Cyrillic-а paypal homograph). Verified headless: the phish and IDN messages are flagged, the honest ones are not, click shows the confirm and does not navigate, Cancel stays, Open anyway opens the real target.