Sanitize links in citation

[compulim]

Changelog Entry

Breaking changes

• Root-level (unconnected) Claim entity is being deprecated, in PR #5564, by @compulim. It will be removed on or after 2027-08-29
  • Use entities[@id=""][@type="Message"].citation[@type="Claim"] instead

Added

• Added link sanitization and ESLint rules, in PR #5564, by @compulim

Removed

• Root-level (unconnected) Claim entity is being deprecated, in PR #5564, by @compulim. It will be removed on or after 2027-08-29
  • Use entities[@id=""][@type="Message"].citation[@type="Claim"] instead

Description

Adding sanitization to links used in citation. Also URL in Markdown reference style link is source-of-truth, the URL in Claim entity is treated as auxiliary/redundant.

Design

As sanitization is done by HTML content transformer, we are leveraging the HTML content transformer to detect whether links (HREFs) should be sanitized.

If web developers want to change what URL scheme is supported, they should modify the sanitization engine in the HTML content transformer.

Citation

There are 2 types of citation, and their behaviors:

• Citation link (a link to the cited text)
  • If link is safe, the link will be available to tap
  • Otherwise, the link is unsafe and they will be removed from Markdown text and reference style link (a.k.a. footnote)
• Non-URL citation (cited text is inline in the message activity)
  • Link is never presented

Single source of truth

For citation, the URL can be set at both Markdown reference style link and Claim entity.

If the are inconsistent, a warning will be presented and the URL from Markdown reference style is used as the source of truth.

In other word, the URL presented in Claim entity is always ignored.

For "plain text" channels such as email/SMS, they cannot use the Claim entity. Thus, Claim entity is always designed to be an auxiliary/redundant data.

Specific Changes

• Updated .eslintrc.yml to detect <a> via react/forbid-elements rule

• I have added tests and executed them locally
• I have updated CHANGELOG.md
• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Pull Request Overview

This PR adds link sanitization to citation components to prevent malicious links and enforces ESLint rules to prevent direct use of anchor elements. The changes establish Markdown reference-style links as the single source of truth for URLs over entity-defined URLs.

• Implements centralized link sanitization through HTML content transformer
• Adds ESLint rules to prevent direct <a> element usage
• Updates citation logic to prefer Markdown URLs over entity URLs

Reviewed Changes

Copilot reviewed 13 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/component/src/hooks/internal/useSanitizeHrefCallback.ts	New hook for sanitizing URLs using HTML content transformer
packages/component/src/LinkDefinition/LinkDefinitionItem.tsx	Updated to use sanitized URLs and added prop validation
packages/component/src/Attachment/Text/private/MarkdownTextContent.tsx	Major refactor to implement URL sanitization and single source of truth logic
packages/component/src/Attachment/FileContent.tsx	Renamed variable for clarity and added ESLint disable comment
packages/component/src/ActivityStatus/private/Originator.tsx	Added URL sanitization and prop validation
.eslintrc.react.yml	Added ESLint rule to forbid direct anchor element usage
tests/html2/citation/	Test files for validating sanitization behavior

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}