Prevent Disguised Links

components/text.js

@@ -12,7 +12,7 @@ import Thumb from '@/svgs/thumb-up-fill.svg'
 import { toString } from 'mdast-util-to-string'
 import copy from 'clipboard-copy'
 import MediaOrLink from './media-or-link'
-import { IMGPROXY_URL_REGEXP, parseInternalLinks, decodeProxyUrl } from '@/lib/url'
+import { IMGPROXY_URL_REGEXP, isMisleadingLink, parseInternalLinks, decodeProxyUrl } from '@/lib/url'
 import reactStringReplace from 'react-string-replace'
 import { rehypeInlineCodeProperty, rehypeStyler } from '@/lib/md'
 import { Button } from 'react-bootstrap'
@@ -176,9 +176,13 @@ export default memo(function Text ({ rel, imgproxyUrls, children, tab, itemId, o
         return href
       }
 
-      // If [text](url) was parsed as <a> and text is not empty and not a link itself,
-      // we don't render it as an image since it was probably a conscious choice to include text.
-      const text = children[0]
+      let text = children[0]
+
+      // Prevents text being used to appear like a link
+      if (isMisleadingLink(text, href)) {
+        text = href
+      }
+
       let url
       try {
         url = !href.startsWith('/') && new URL(href)
@@ -254,7 +258,7 @@ export default memo(function Text ({ rel, imgproxyUrls, children, tab, itemId, o
       }
 
       // assume the link is an image which will fallback to link if it's not
-      return <TextMediaOrLink src={href} rel={rel ?? UNKNOWN_LINK_REL} {...props}>{children}</TextMediaOrLink>
+      return <TextMediaOrLink src={href} rel={rel ?? UNKNOWN_LINK_REL} {...props}>{text}</TextMediaOrLink>
     },
     img: TextMediaOrLink
   }), [outlawed, rel, itemId, Code, P, Heading, Table, TextMediaOrLink])

lib/url.js

@@ -183,6 +183,22 @@ export function parseEmbedUrl (href) {
   return null
 }
 
+export function isMisleadingLink (text, href) {
+  let misleading = false
+
+  if (/^\s*(\w+\.)+\w+/.test(text)) {
+    try {
+      const hrefUrl = new URL(href)
+
+      if (new URL(hrefUrl.protocol + text).origin !== hrefUrl.origin) {
+        misleading = true
+      }
+    } catch {}
+  }
+
+  return misleading
+}
+
 export function stripTrailingSlash (uri) {
   return uri.endsWith('/') ? uri.slice(0, -1) : uri
 }