fix: sanitizeUrl incorrectly rewrites internal navigation links by vmridul · Pull Request #39706 · RocketChat/Rocket.Chat

vmridul · 2026-03-18T13:00:11Z

Problem

sanitizeUrl() was forcing all protocol less URLs into protocol relative form (//...), which broke internal links like /channel/general, ./docs, #section, ?tab=files. This caused rendered markdown links in messages to navigate incorrectly or fail.

Before

When a user posted a markdown link to an internal page or anchor:

/channel/general was rewritten as ///channel/general (browser treats this as a network request instead of a route)
#section was rewritten as //#section
?tab=files was rewritten as //?tab=files

Result: clicking internal links in chat messages would either navigate to wrong page or stay on current page.

After

Internal link patterns are now recognized and passed through unchanged:

/channel/general stays /channel/general
#section stays #section
?tab=files stays ?tab=files

All other link types continue to work normally (external domains, XSS blocking, etc.)

Solution

Added a check to preserve URLs starting with /, ./, ../, #, or ? before the existing domain-rewriting logic.

Changes

packages/gazzodown/src/elements/sanitizeUrl.ts: Added check to preserve internal/local URLs
packages/gazzodown/src/elements/sanitizeUrl.spec.ts: Added 3 test cases covering relative paths, hash fragments, and query only links

Summary by CodeRabbit

Bug Fixes
- Fixed an issue where internal navigation links were being incorrectly rewritten. Relative paths, hash fragments, and query parameters are now preserved and function correctly.
Tests
- Added comprehensive test coverage to ensure relative paths, hash fragments, and query-only links are properly handled.

dionisio-bot · 2026-03-18T13:00:16Z

Looks like this PR is not ready to merge, because of the following issues:

This PR is missing the 'stat: QA assured' label
This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

changeset-bot · 2026-03-18T13:00:23Z

🦋 Changeset detected

Latest commit: 0da95e2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 41 packages

Name	Type
@rocket.chat/gazzodown	Patch
@rocket.chat/meteor	Patch
@rocket.chat/fuselage-ui-kit	Patch
@rocket.chat/livechat	Patch
@rocket.chat/uikit-playground	Patch
@rocket.chat/ui-voip	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch
@rocket.chat/api-client	Patch
@rocket.chat/apps	Patch
@rocket.chat/core-services	Patch
@rocket.chat/cron	Patch
@rocket.chat/ddp-client	Patch
@rocket.chat/http-router	Patch
@rocket.chat/model-typings	Patch
@rocket.chat/ui-avatar	Patch
@rocket.chat/ui-client	Patch
@rocket.chat/ui-contexts	Patch
@rocket.chat/web-ui-registration	Patch
@rocket.chat/account-service	Patch
@rocket.chat/authorization-service	Patch
@rocket.chat/ddp-streamer	Patch
@rocket.chat/omnichannel-transcript	Patch
@rocket.chat/presence-service	Patch
@rocket.chat/queue-worker	Patch
@rocket.chat/abac	Patch
@rocket.chat/federation-matrix	Patch
@rocket.chat/license	Patch
@rocket.chat/media-calls	Patch
@rocket.chat/omnichannel-services	Patch
@rocket.chat/pdf-worker	Patch
@rocket.chat/presence	Patch
rocketchat-services	Patch
@rocket.chat/models	Patch
@rocket.chat/network-broker	Patch
@rocket.chat/omni-core-ee	Patch
@rocket.chat/mock-providers	Patch
@rocket.chat/ui-video-conf	Patch
@rocket.chat/instance-status	Patch
@rocket.chat/omni-core	Patch
@rocket.chat/server-fetch	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-03-18T13:00:50Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cc57bfba-10b5-4f6a-bd1b-f10368181523

📥 Commits

Reviewing files that changed from the base of the PR and between 6f76232 and 0da95e2.

📒 Files selected for processing (3)

.changeset/stale-sheep-join.md
packages/gazzodown/src/elements/sanitizeUrl.spec.ts
packages/gazzodown/src/elements/sanitizeUrl.ts

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (2)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

packages/gazzodown/src/elements/sanitizeUrl.spec.ts
packages/gazzodown/src/elements/sanitizeUrl.ts

**/*.spec.ts

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.spec.ts: Use descriptive test names that clearly communicate expected behavior in Playwright tests
Use .spec.ts extension for test files (e.g., login.spec.ts)

Files:

packages/gazzodown/src/elements/sanitizeUrl.spec.ts

🧠 Learnings (14)

📓 Common learnings

Learnt from: smirk-dev
Repo: RocketChat/Rocket.Chat PR: 39625
File: apps/meteor/app/api/server/v1/push.ts:85-97
Timestamp: 2026-03-14T14:58:58.834Z
Learning: In RocketChat/Rocket.Chat, the `push.token` POST/DELETE endpoints in `apps/meteor/app/api/server/v1/push.ts` were already migrated to the chained router API pattern on `develop` prior to PR `#39625`. `cleanTokenResult` (which strips `authToken` and returns `PushTokenResult`) and `isPushTokenPOSTProps`/`isPushTokenDELETEProps` validators already exist on `develop`. PR `#39625` only migrates `push.get` and `push.info` to the chained pattern. Do not flag `cleanTokenResult` or `PushTokenResult` as newly introduced behavior-breaking changes when reviewing this PR.

Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 39397
File: packages/gazzodown/src/elements/Timestamp/RelativeTime.spec.tsx:63-70
Timestamp: 2026-03-06T18:02:20.381Z
Learning: In RocketChat/Rocket.Chat, tests in the `packages/gazzodown` package (and likely the broader test suite) are always expected to run in the UTC timezone. This makes `toLocaleString()` output deterministic, so snapshot tests that include locale/timezone-sensitive content (such as `title` attributes from `toLocaleString()`) are stable and do not need to be replaced with targeted assertions.

📚 Learning: 2026-03-16T21:50:37.589Z

Learnt from: amitb0ra
Repo: RocketChat/Rocket.Chat PR: 39676
File: .changeset/migrate-users-register-openapi.md:3-3
Timestamp: 2026-03-16T21:50:37.589Z
Learning: For changes related to OpenAPI migrations in Rocket.Chat/OpenAPI, when removing endpoint types and validators from rocket.chat/rest-typings (e.g., UserRegisterParamsPOST, /v1/users.register) document this as a minor changeset (not breaking) per RocketChat/Rocket.Chat-Open-API#150 Rule 7. Note that the endpoint type is re-exposed via a module augmentation .d.ts in the consuming package (e.g., packages/web-ui-registration/src/users-register.d.ts). In reviews, ensure the changeset clearly states: this is a non-breaking change, the major version should not be bumped, and the changeset reflects a minor version bump. Do not treat this as a breaking change during OpenAPI migrations.

Applied to files:

.changeset/stale-sheep-join.md