diff --git a/packages/design-system/src/assets/icons/resource-type-url-fill.svg b/packages/design-system/src/assets/icons/resource-type-url-fill.svg
new file mode 100644
index 00000000000..2efc62595c3
--- /dev/null
+++ b/packages/design-system/src/assets/icons/resource-type-url-fill.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+    <g>
+        <path fill="none" d="M0 0h24v24H0z"/>
+        <path d="M10 6v2H5v11h11v-5h2v6a1 1 0 0 1-1 1H4a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1h6zm11-3v9l-3.794-3.793-5.999 6-1.414-1.414 5.999-6L12 3h9z"/>
+    </g>
+</svg>
diff --git a/packages/design-system/src/helpers/resourceIconMapping.json b/packages/design-system/src/helpers/resourceIconMapping.json
index 95ec7bcad08..1c6765c280e 100644
--- a/packages/design-system/src/helpers/resourceIconMapping.json
+++ b/packages/design-system/src/helpers/resourceIconMapping.json
@@ -387,6 +387,10 @@
     "name": "resource-type-text",
     "color": "var(--oc-color-text-default)"
   },
+  "url": {
+    "name": "resource-type-url",
+    "color": "var(--oc-color-text-default)"
+  },
   "vsd": {
     "name": "resource-type-document",
     "color": "var(--oc-color-icon-document)"
diff --git a/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue b/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue
index d6e658fdaea..f1eb15bb667 100644
--- a/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue
+++ b/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue
@@ -1,4 +1,9 @@
 <template>
+  <create-shortcut-modal
+    v-if="isCreateNewShortcutModalOpen"
+    :space="space"
+    :cancel="closeCreateNewShortcutModal"
+  />
   <div v-if="showActions" class="create-and-upload-actions oc-flex-inline oc-mr-s">
     <template v-if="createFileActionsAvailable">
       <span v-oc-tooltip="newButtonTooltip">
@@ -56,6 +61,12 @@
               </oc-button>
             </li>
           </template>
+          <li class="create-list-shortcut oc-menu-item-hover">
+            <oc-button id="new-shortcut-btn" appearance="raw" @click="createNewShortcutAction">
+              <oc-icon name="external-link" size="medium" />
+              <span v-text="$gettext('Shortcut')" />
+            </oc-button>
+          </li>
         </oc-list>
       </oc-drop>
     </template>
@@ -123,7 +134,8 @@
             :disabled="isActionDisabled(action)"
             @click="action.handler"
           >
-            <oc-icon :name="action.icon" fill-type="line" /><span v-text="action.label()"
+            <oc-icon :name="action.icon" fill-type="line" />
+            <span v-text="action.label()"
           /></oc-button>
         </li>
       </oc-list>
@@ -159,16 +171,13 @@
 <script lang="ts">
 import { mapActions, mapGetters } from 'vuex'
 
-import { useFileActions } from '@ownclouders/web-pkg'
+import { useFileActions, useFileActionsCreateNewShortcut } from '@ownclouders/web-pkg'
 import { isLocationPublicActive, isLocationSpacesActive } from '@ownclouders/web-pkg'
 import { useActiveLocation } from '@ownclouders/web-pkg'
 import {
   useFileActionsCreateNewFile,
   useFileActionsCreateNewFolder,
-  useFileActionsPaste
-} from '@ownclouders/web-pkg'
-
-import {
+  useFileActionsPaste,
   useRequest,
   useCapabilityShareJailEnabled,
   useCapabilitySpacesEnabled,
@@ -178,6 +187,8 @@ import {
 } from '@ownclouders/web-pkg'
 
 import ResourceUpload from './Upload/ResourceUpload.vue'
+import CreateShortcutModal from '@ownclouders/web-pkg/src/components/CreateShortcutModal.vue'
+
 import {
   computed,
   defineComponent,
@@ -200,7 +211,8 @@ import { v4 as uuidv4 } from 'uuid'
 
 export default defineComponent({
   components: {
-    ResourceUpload
+    ResourceUpload,
+    CreateShortcutModal
   },
   props: {
     space: {
@@ -256,6 +268,14 @@ export default defineComponent({
     })
     const createNewFolderAction = computed(() => unref(createNewFolder)[0].handler)
 
+    const {
+      actions: createNewShortcut,
+      modalOpen: isCreateNewShortcutModalOpen,
+      closeModal: closeCreateNewShortcutModal
+    } = useFileActionsCreateNewShortcut({ store })
+
+    const createNewShortcutAction = computed(() => unref(createNewShortcut)[0].handler)
+
     const newFileHandlers = computed(() => store.getters.newFileHandlers)
 
     const { actions: createNewFileActions } = useFileActionsCreateNewFile({
@@ -396,11 +416,14 @@ export default defineComponent({
       createNewFolder,
       mimetypesAllowedForCreation,
       createNewFolderAction,
+      createNewShortcutAction,
       extensionActions,
       pasteFileAction,
       isActionDisabled,
       actionKeySuffix,
       showDrop,
+      isCreateNewShortcutModalOpen,
+      closeCreateNewShortcutModal,
 
       // HACK: exported for unit tests:
       onUploadComplete
diff --git a/packages/web-app-files/tests/unit/components/AppBar/__snapshots__/CreateAndUpload.spec.ts.snap b/packages/web-app-files/tests/unit/components/AppBar/__snapshots__/CreateAndUpload.spec.ts.snap
index 943c61d4bd1..420dfed1bda 100644
--- a/packages/web-app-files/tests/unit/components/AppBar/__snapshots__/CreateAndUpload.spec.ts.snap
+++ b/packages/web-app-files/tests/unit/components/AppBar/__snapshots__/CreateAndUpload.spec.ts.snap
@@ -1,6 +1,8 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`CreateAndUpload component action buttons should show and be enabled if file creation is possible 1`] = `
+<!--v-if-->
+
 <div class="create-and-upload-actions oc-flex-inline oc-mr-s">
   <span>
     <button aria-label="Create a new folder" class="oc-button oc-rounded oc-button-m oc-button-justify-content-center oc-button-gap-m oc-button-primary oc-button-primary-filled" id="new-folder-btn" type="button">
@@ -34,6 +36,8 @@ exports[`CreateAndUpload component action buttons should show and be enabled if
 `;
 
 exports[`CreateAndUpload component file handlers should show additional handlers 1`] = `
+<!--v-if-->
+
 <div class="create-and-upload-actions oc-flex-inline oc-mr-s">
   <span>
     <button aria-label="Create new files or folders" class="oc-button oc-rounded oc-button-m oc-button-justify-content-center oc-button-gap-m oc-button-primary oc-button-primary-filled" id="new-file-menu-btn" type="button">
@@ -77,6 +81,14 @@ exports[`CreateAndUpload component file handlers should show additional handlers
           <span>Draw.io document</span>
         </button>
       </li>
+      <li class="create-list-shortcut oc-menu-item-hover">
+        <button class="oc-button oc-rounded oc-button-m oc-button-justify-content-center oc-button-gap-m oc-button-passive oc-button-passive-raw" id="new-shortcut-btn" type="button">
+          <!--v-if-->
+          <!-- @slot Content of the button -->
+          <oc-icon-stub accessiblelabel="" color="" filltype="fill" name="external-link" size="medium" type="span" variation="passive"></oc-icon-stub>
+          <span>Shortcut</span>
+        </button>
+      </li>
     </oc-list-stub>
   </oc-drop-stub>
   <span>
diff --git a/packages/web-pkg/package.json b/packages/web-pkg/package.json
index 2b8d560579d..11b8e3534f4 100644
--- a/packages/web-pkg/package.json
+++ b/packages/web-pkg/package.json
@@ -18,10 +18,10 @@
     "zod": "^3.22.4"
   },
   "peerDependencies": {
-    "@ownclouders/web-client": "workspace:*",
     "@casl/ability": "^6.3.3",
     "@casl/vue": "^2.2.1",
     "@microsoft/fetch-event-source": "^2.0.1",
+    "@ownclouders/web-client": "workspace:*",
     "@uppy/core": "^3.2.0",
     "@uppy/drop-target": "^2.0.0",
     "@uppy/tus": "^3.1.0",
@@ -36,9 +36,9 @@
     "lodash-es": "^4.17.21",
     "luxon": "^2.4.0",
     "mark.js": "^8.11.1",
+    "p-queue": "^6.6.2",
     "password-sheriff": "^1.1.1",
     "pinia": "^2.1.3",
-    "p-queue": "^6.6.2",
     "qs": "^6.10.3",
     "semver": "^7.3.8",
     "uuid": "^9.0.0",
@@ -46,6 +46,6 @@
     "vue-router": "4.2.0",
     "vue3-gettext": "2.5.0-alpha.1",
     "vuex": "4.1.0",
-    "@microsoft/fetch-event-source": "^2.0.1"
+    "dompurify": "^3.0.6"
   }
 }
diff --git a/packages/web-pkg/src/components/CreateShortcutModal.vue b/packages/web-pkg/src/components/CreateShortcutModal.vue
new file mode 100644
index 00000000000..37e69132643
--- /dev/null
+++ b/packages/web-pkg/src/components/CreateShortcutModal.vue
@@ -0,0 +1,94 @@
+<template>
+  <portal to="app.runtime.modal">
+    <oc-modal
+      :title="$gettext('Create a Shortcut')"
+      :button-cancel-text="$gettext('Cancel')"
+      :button-confirm-text="$gettext('Create')"
+      :button-confirm-disabled="confirmButtonDisabled"
+      @cancel="cancel"
+      @confirm="createShortcut"
+    >
+      <template #content>
+        url
+        <oc-text-input v-model="inputUrl" />
+        <div class="oc-flex oc-flex-bottom oc-width-1-1 oc-mt-m">
+          <oc-text-input
+            v-model="inputFilename"
+            class="oc-width-1-1"
+            :label="$gettext('Shortcut name')"
+          />
+          <span class="oc-ml-s">.url</span>
+        </div>
+      </template>
+    </oc-modal>
+  </portal>
+</template>
+
+<script lang="ts">
+import { defineComponent, PropType, ref, unref, computed } from 'vue'
+import { SpaceResource } from '@ownclouders/web-client'
+import { useClientService, useStore } from '../composables'
+import { urlJoin } from '@ownclouders/web-client/src/utils'
+import { useGettext } from 'vue3-gettext'
+import DOMPurify from 'dompurify'
+
+export default defineComponent({
+  name: 'CreateShortcutModal',
+  props: {
+    space: {
+      type: Object as PropType<SpaceResource>,
+      required: true
+    },
+    cancel: {
+      type: Function as PropType<(...args: any) => unknown>,
+      required: true
+    }
+  },
+  setup(props) {
+    const clientService = useClientService()
+    const { $gettext } = useGettext()
+    const store = useStore()
+    const inputUrl = ref('')
+    const inputFilename = ref('')
+    const confirmButtonDisabled = computed(() => !(unref(inputUrl) && unref(inputFilename)))
+
+    const currentFolder = computed(() => {
+      return store.getters['Files/currentFolder']
+    })
+
+    const createShortcut = async () => {
+      // Closes the modal
+      props.cancel()
+
+      try {
+        // Omit possible xss code
+        const sanitizedUrl = DOMPurify.sanitize(unref(inputUrl), { USE_PROFILES: { html: true } })
+
+        const content = `[InternetShortcut]\nURL=${unref(sanitizedUrl)}`
+        const path = urlJoin(unref(currentFolder).path, `${unref(inputFilename)}.url`)
+        const resource = await clientService.webdav.putFileContents(props.space, {
+          path,
+          content
+        })
+        store.commit('Files/UPSERT_RESOURCE', resource)
+        store.dispatch('showMessage', {
+          title: $gettext('Shortcut was created successfully')
+        })
+      } catch (e) {
+        console.error(e)
+        store.dispatch('showErrorMessage', {
+          title: $gettext('Failed to create shortcut'),
+          error: e
+        })
+      }
+    }
+
+    return {
+      confirmButtonDisabled,
+      createShortcut,
+      inputUrl,
+      inputFilename
+    }
+  }
+})
+</script>
diff --git a/packages/web-pkg/src/components/FilesList/ContextActions.vue b/packages/web-pkg/src/components/FilesList/ContextActions.vue
index 9fc8d86e027..e26a2ab0aca 100644
--- a/packages/web-pkg/src/components/FilesList/ContextActions.vue
+++ b/packages/web-pkg/src/components/FilesList/ContextActions.vue
@@ -5,7 +5,11 @@
 <script lang="ts">
 import ContextActionMenu from '../ContextActions/ContextActionMenu.vue'
 
-import { useFileActionsToggleHideShare, useStore } from '../../composables'
+import {
+  useFileActionsOpenShortcut,
+  useFileActionsToggleHideShare,
+  useStore
+} from '../../composables'
 import { computed, defineComponent, PropType, Ref, toRef, unref } from 'vue'
 
 import {
@@ -71,6 +75,7 @@ export default defineComponent({
       store
     })
     const { actions: showSharesActions } = useFileActionsShowShares({ store })
+    const { actions: openShortcutActions } = useFileActionsOpenShortcut({ store })
 
     // type cast to make vue-tsc aware of the type
     const actionOptions = toRef(props, 'actionOptions') as Ref<FileActionOptions>
@@ -107,6 +112,7 @@ export default defineComponent({
 
     const menuItemsActions = computed(() => {
       return [
+        ...unref(openShortcutActions),
         ...unref(downloadArchiveActions),
         ...unref(downloadFileActions),
         ...unref(deleteActions),
diff --git a/packages/web-pkg/src/components/index.ts b/packages/web-pkg/src/components/index.ts
index 806502c1ca1..99d8456e672 100644
--- a/packages/web-pkg/src/components/index.ts
+++ b/packages/web-pkg/src/components/index.ts
@@ -20,3 +20,4 @@ export { default as SpaceQuota } from './SpaceQuota.vue'
 export { default as SearchBarFilter } from './SearchBarFilter.vue'
 export { default as ViewOptions } from './ViewOptions.vue'
 export { default as PortalTarget } from './PortalTarget.vue'
+export { default as CreateShortcutModal } from './CreateShortcutModal.vue'
diff --git a/packages/web-pkg/src/composables/actions/files/index.ts b/packages/web-pkg/src/composables/actions/files/index.ts
index 0ff81baa772..5cfdf0ad54d 100644
--- a/packages/web-pkg/src/composables/actions/files/index.ts
+++ b/packages/web-pkg/src/composables/actions/files/index.ts
@@ -23,3 +23,5 @@ export * from './useFileActionsShowShares'
 export * from './useFileActionsCreateSpaceFromResource'
 export * from './useFileActionsCreateNewFolder'
 export * from './useFileActionsCreateNewFile'
+export * from './useFileActionsCreateNewShortcut'
+export * from './useFileActionsOpenShortcut'
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActions.ts b/packages/web-pkg/src/composables/actions/files/useFileActions.ts
index 30039e2d77b..d8f3ff895f2 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActions.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActions.ts
@@ -14,6 +14,7 @@ import {
   Action,
   FileAction,
   FileActionOptions,
+  useFileActionsOpenShortcut,
   useIsSearchActive,
   useWindowOpen
 } from '../../actions'
@@ -68,8 +69,10 @@ export const useFileActions = ({ store }: { store?: Store<any> } = {}) => {
   const { actions: restoreActions } = useFileActionsRestore({ store })
   const { actions: showEditTagsActions } = useFileActionsShowEditTags({ store })
   const { actions: createSpaceFromResource } = useFileActionsCreateSpaceFromResource({ store })
+  const { actions: openShortcutActions } = useFileActionsOpenShortcut({ store })
 
   const systemActions = computed((): Action[] => [
+    ...unref(openShortcutActions),
     ...unref(downloadArchiveActions),
     ...unref(downloadFileActions),
     ...unref(deleteActions),
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsCreateNewShortcut.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsCreateNewShortcut.ts
new file mode 100644
index 00000000000..96e1ecfb6e4
--- /dev/null
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsCreateNewShortcut.ts
@@ -0,0 +1,46 @@
+import { Resource } from '@ownclouders/web-client/src/helpers'
+import { Store } from 'vuex'
+import { computed, unref, ref } from 'vue'
+import { useStore } from '../../store'
+import { FileAction } from '../../../'
+import { useGettext } from 'vue3-gettext'
+
+export const useFileActionsCreateNewShortcut = ({ store }: { store?: Store<any> } = {}) => {
+  store = store || useStore()
+  const { $gettext } = useGettext()
+  const currentFolder = computed((): Resource => store.getters['Files/currentFolder'])
+
+  const modalOpen = ref(false)
+
+  const closeModal = () => {
+    modalOpen.value = false
+  }
+
+  const handler = () => {
+    modalOpen.value = true
+  }
+
+  const actions = computed((): FileAction[] => {
+    return [
+      {
+        name: 'create-shortcut',
+        icon: 'external-link',
+        handler,
+        label: () => {
+          return $gettext('New Shortcut')
+        },
+        isEnabled: () => {
+          return unref(currentFolder)?.canCreate()
+        },
+        componentType: 'button',
+        class: 'oc-files-actions-create-new-shortcut'
+      }
+    ]
+  })
+
+  return {
+    actions,
+    modalOpen,
+    closeModal
+  }
+}
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsOpenShortcut.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsOpenShortcut.ts
new file mode 100644
index 00000000000..34305f06733
--- /dev/null
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsOpenShortcut.ts
@@ -0,0 +1,93 @@
+import {
+  isLocationCommonActive,
+  isLocationPublicActive,
+  isLocationSharesActive,
+  isLocationSpacesActive
+} from '../../../router'
+import { useIsFilesAppActive } from '../helpers'
+import { useRouter } from '../../router'
+import { FileAction, FileActionOptions } from '../types'
+import { useIsSearchActive } from '../helpers'
+import { computed, unref } from 'vue'
+import { useGettext } from 'vue3-gettext'
+import { Store } from 'vuex'
+import { useClientService } from '../../clientService'
+import DOMPurify from 'dompurify'
+
+export const useFileActionsOpenShortcut = ({ store }: { store?: Store<any> } = {}) => {
+  const router = useRouter()
+  const { $gettext } = useGettext()
+  const isFilesAppActive = useIsFilesAppActive()
+  const isSearchActive = useIsSearchActive()
+  const clientService = useClientService()
+
+  const extractUrl = (fileContents: string) => {
+    const regex = /URL=(.+)/
+    const match = fileContents.match(regex)
+
+    if (match && match[1]) {
+      return match[1]
+    } else {
+      throw new Error('unable to extract url')
+    }
+  }
+  const handler = async ({ resources, space }: FileActionOptions) => {
+    try {
+      const fileContents = (await clientService.webdav.getFileContents(space, resources[0])).body
+      const url = extractUrl(fileContents)
+
+      // Omit possible xss code
+      const sanitizedUrl = DOMPurify.sanitize(url, { USE_PROFILES: { html: true } })
+
+      window.open(sanitizedUrl)
+    } catch (e) {
+      console.error(e)
+      store.dispatch('showErrorMessage', {
+        title: $gettext('Failed to open shortcut'),
+        error: e
+      })
+    }
+  }
+
+  const actions = computed((): FileAction[] => [
+    {
+      name: 'open-shortcut',
+      icon: 'external-link',
+      handler,
+      label: () => {
+        return $gettext('Open shortcut')
+      },
+      isEnabled: ({ resources }) => {
+        if (
+          unref(isFilesAppActive) &&
+          !unref(isSearchActive) &&
+          !isLocationSpacesActive(router, 'files-spaces-generic') &&
+          !isLocationPublicActive(router, 'files-public-link') &&
+          !isLocationCommonActive(router, 'files-common-favorites') &&
+          !isLocationCommonActive(router, 'files-common-search') &&
+          !isLocationSharesActive(router, 'files-shares-with-me') &&
+          !isLocationSharesActive(router, 'files-shares-with-others') &&
+          !isLocationSharesActive(router, 'files-shares-via-link')
+        ) {
+          return false
+        }
+        if (resources.length !== 1) {
+          return false
+        }
+        if (resources[0].extension !== 'url') {
+          return false
+        }
+        return resources[0].canDownload()
+      },
+      componentType: 'button',
+      class: 'oc-files-actions-open-short-cut-trigger'
+    }
+  ])
+
+  return {
+    actions,
+
+    // Hack for unit tests
+    extractUrl
+  }
+}
diff --git a/packages/web-pkg/tests/unit/composables/actions/files/useFileActionsCreateNewShortcut.spec.ts b/packages/web-pkg/tests/unit/composables/actions/files/useFileActionsCreateNewShortcut.spec.ts
new file mode 100644
index 00000000000..d910a629527
--- /dev/null
+++ b/packages/web-pkg/tests/unit/composables/actions/files/useFileActionsCreateNewShortcut.spec.ts
@@ -0,0 +1,85 @@
+import { mock } from 'jest-mock-extended'
+import { unref } from 'vue'
+import {
+  createStore,
+  defaultComponentMocks,
+  defaultStoreMockOptions,
+  RouteLocation,
+  getComposableWrapper
+} from 'web-test-helpers'
+import { useFileActionsCreateNewShortcut } from '../../../../../src'
+import { Resource } from '@ownclouders/web-client'
+
+describe('createNewShortcut', () => {
+  describe('computed property "actions"', () => {
+    describe('method "isEnabled"', () => {
+      it.each([
+        {
+          currentFolderCanCreate: true,
+          expectedStatus: true
+        },
+        {
+          currentFolderCanCreate: false,
+          expectedStatus: false
+        }
+      ])('should be set correctly', ({ currentFolderCanCreate, expectedStatus }) => {
+        getWrapper({
+          currentFolder: mock<Resource>({ canCreate: () => currentFolderCanCreate }),
+          setup: ({ actions }) => {
+            expect(unref(actions)[0].isEnabled()).toBe(expectedStatus)
+          }
+        })
+      })
+    })
+    describe('method "handler"', () => {
+      it('sets property "modalOpen" to true', () => {
+        getWrapper({
+          setup: ({ actions, modalOpen }) => {
+            unref(actions)[0].handler()
+            expect(unref(modalOpen)).toBe(true)
+          }
+        })
+      })
+    })
+  })
+})
+
+function getWrapper({
+  setup,
+  currentFolder = mock<Resource>()
+}: {
+  setup: (
+    instance: ReturnType<typeof useFileActionsCreateNewShortcut>,
+    options: {
+      storeOptions: typeof defaultStoreMockOptions
+    }
+  ) => void
+  currentFolder?: Resource
+}) {
+  const mocks = {
+    ...defaultComponentMocks({
+      currentRoute: mock<RouteLocation>({ name: 'files-spaces-generic' })
+    })
+  }
+
+  const storeOptions = {
+    ...defaultStoreMockOptions
+  }
+  storeOptions.modules.Files.getters.currentFolder.mockReturnValue(currentFolder)
+
+  const store = createStore(storeOptions)
+
+  return {
+    wrapper: getComposableWrapper(
+      () => {
+        const instance = useFileActionsCreateNewShortcut({ store })
+        setup(instance, { storeOptions })
+      },
+      {
+        store,
+        mocks,
+        provide: mocks
+      }
+    )
+  }
+}
diff --git a/packages/web-pkg/tests/unit/composables/actions/files/useFileActionsOpenShortcut.spec.ts b/packages/web-pkg/tests/unit/composables/actions/files/useFileActionsOpenShortcut.spec.ts
new file mode 100644
index 00000000000..1a8e02c8549
--- /dev/null
+++ b/packages/web-pkg/tests/unit/composables/actions/files/useFileActionsOpenShortcut.spec.ts
@@ -0,0 +1,143 @@
+import { mock } from 'jest-mock-extended'
+import { ref, unref } from 'vue'
+import {
+  createStore,
+  defaultComponentMocks,
+  defaultStoreMockOptions,
+  RouteLocation,
+  getComposableWrapper
+} from 'web-test-helpers'
+import { useFileActionsOpenShortcut, useRoute } from '../../../../../src'
+import { Resource } from '@ownclouders/web-client'
+import { GetFileContentsResponse } from '@ownclouders/web-client/src/webdav/getFileContents'
+
+jest.mock('../../../../../src/composables/router', () => ({
+  ...jest.requireActual('../../../../../src/composables/router'),
+  useRoute: jest.fn()
+}))
+
+window = Object.create(window)
+Object.defineProperty(window, 'location', {
+  value: {
+    href: ''
+  },
+  writable: true
+})
+Object.defineProperty(window, 'open', { writable: true })
+window.open = jest.fn()
+
+describe('openShortcut', () => {
+  describe('computed property "actions"', () => {
+    describe('method "isEnabled"', () => {
+      it.each([
+        {
+          resources: [],
+          expectedStatus: false
+        },
+        {
+          resources: [mock<Resource>({ extension: 'txt' })],
+          expectedStatus: false
+        },
+        {
+          resources: [mock<Resource>({ extension: 'url', canDownload: () => false })],
+          expectedStatus: false
+        },
+        {
+          resources: [mock<Resource>({ extension: 'url', canDownload: () => true })],
+          expectedStatus: true
+        }
+      ])('should be set correctly', ({ resources, expectedStatus }) => {
+        getWrapper({
+          setup: ({ actions }) => {
+            expect(unref(actions)[0].isEnabled({ resources, space: null })).toBe(expectedStatus)
+          }
+        })
+      })
+    })
+    describe('method "handler"', () => {
+      it('omits xss code and opens the url in a new tab', () => {
+        getWrapper({
+          getFileContentsValue:
+            '[InternetShortcut]\nURL=https://owncloud.com?default=<script>alert(document.cookie)</script>',
+          setup: async ({ actions }) => {
+            await unref(actions)[0].handler({
+              resources: [mock<Resource>()],
+              space: null
+            })
+            expect(window.open).toHaveBeenCalledWith('https://owncloud.com?default=')
+          }
+        })
+      })
+    })
+  })
+  describe('method "extractUrl"', () => {
+    it('extracts url correctly', () => {
+      getWrapper({
+        setup: ({ extractUrl }) => {
+          expect(extractUrl('[InternetShortcut]\n' + 'URL=https://owncloud.com')).toEqual(
+            'https://owncloud.com'
+          )
+        }
+      })
+    })
+    it('throws error if url cannot be extracted', () => {
+      getWrapper({
+        setup: ({ extractUrl }) => {
+          expect(() => extractUrl('�������')).toThrow('unable to extract url')
+        }
+      })
+    })
+  })
+})
+
+function getWrapper({
+  setup,
+  getFileContentsValue = null
+}: {
+  getFileContentsValue?: string
+  setup: (
+    instance: ReturnType<typeof useFileActionsOpenShortcut>,
+    options: {
+      storeOptions: typeof defaultStoreMockOptions
+    }
+  ) => void
+}) {
+  const mocks = {
+    ...defaultComponentMocks({
+      currentRoute: mock<RouteLocation>({ name: 'files-spaces-generic' })
+    })
+  }
+
+  // url contains xss code to test xss protection
+  mocks.$clientService.webdav.getFileContents.mockResolvedValue(
+    mock<GetFileContentsResponse>({
+      body: getFileContentsValue
+    })
+  )
+
+  jest
+    .mocked(useRoute)
+    .mockImplementation(() =>
+      ref(mock<RouteLocation>({ name: 'files-spaces-generic', path: '/files/' }) as any)
+    )
+
+  const storeOptions = {
+    ...defaultStoreMockOptions
+  }
+
+  const store = createStore(storeOptions)
+
+  return {
+    wrapper: getComposableWrapper(
+      () => {
+        const instance = useFileActionsOpenShortcut({ store })
+        setup(instance, { storeOptions })
+      },
+      {
+        store,
+        mocks,
+        provide: mocks
+      }
+    )
+  }
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fa000ce30fe..517c60d699a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1010,6 +1010,9 @@ importers:
       design-system:
         specifier: workspace:@ownclouders/design-system@*
         version: link:../design-system
+      dompurify:
+        specifier: ^3.0.6
+        version: 3.0.6
       filesize:
         specifier: ^9.0.11
         version: 9.0.11
@@ -10943,6 +10946,10 @@ packages:
     dependencies:
       domelementtype: 2.2.0
 
+  /dompurify@3.0.6:
+    resolution: {integrity: sha512-ilkD8YEnnGh1zJ240uJsW7AzE+2qpbOUYjacomn3AvJ6J4JhKGSZ2nh4wUIXPZrEPppaCLx5jFe8T89Rk8tQ7w==}
+    dev: false
+
   /domutils@2.8.0:
     resolution: {integrity: sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==}
     dependencies: