From 6b1066a1378fb717b33bfd98c226be6153525809 Mon Sep 17 00:00:00 2001
From: Pavel Feldman <pavel.feldman@gmail.com>
Date: Thu, 30 Apr 2026 11:28:07 -0700
Subject: [PATCH] fix(trace-viewer): validate baseURL scheme before linking

---
 packages/isomorphic/urlMatch.ts               | 8 ++++++++
 packages/trace-viewer/src/ui/metadataView.tsx | 5 ++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/packages/isomorphic/urlMatch.ts b/packages/isomorphic/urlMatch.ts
index cdd7f0aab0a61..c6851d996187e 100644
--- a/packages/isomorphic/urlMatch.ts
+++ b/packages/isomorphic/urlMatch.ts
@@ -16,6 +16,14 @@
 
 import { isString } from './stringUtils';
 
+export function isHttpUrl(url: string): boolean {
+  try {
+    return ['http:', 'https:'].includes(new URL(url).protocol);
+  } catch {
+    return false;
+  }
+}
+
 // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions#escaping
 const escapedChars = new Set(['$', '^', '+', '.', '*', '(', ')', '|', '\\', '?', '{', '}', '[', ']']);
 
diff --git a/packages/trace-viewer/src/ui/metadataView.tsx b/packages/trace-viewer/src/ui/metadataView.tsx
index 4fc57799f021d..929a812f3fa08 100644
--- a/packages/trace-viewer/src/ui/metadataView.tsx
+++ b/packages/trace-viewer/src/ui/metadataView.tsx
@@ -15,6 +15,7 @@
 */
 
 import { msToString } from '@isomorphic/formatUtils';
+import { isHttpUrl } from '@isomorphic/urlMatch';
 import * as React from 'react';
 import type { TraceModel } from '@isomorphic/trace/traceModel';
 import './callTab.css';
@@ -41,7 +42,9 @@ export const MetadataView: React.FunctionComponent<{
     {model.options.baseURL && (
       <>
         <div className='call-section' style={{ paddingTop: 2 }}>Config</div>
-        <div className='call-line'>baseURL:<a className='call-value string' href={model.options.baseURL} title={model.options.baseURL} target='_blank' rel='noopener noreferrer'>{model.options.baseURL}</a></div>
+        <div className='call-line'>baseURL:{isHttpUrl(model.options.baseURL)
+          ? <a className='call-value string' href={model.options.baseURL} title={model.options.baseURL} target='_blank' rel='noopener noreferrer'>{model.options.baseURL}</a>
+          : <span className='call-value string' title={model.options.baseURL}>{model.options.baseURL}</span>}</div>
       </>
     )}
     <div className='call-section'>Viewport</div>