Potential fix for code scanning alert no. 3: DOM text reinterpreted as HTML (#153)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: poad

chat-app/components/ai-elements/web-preview.tsx

@@ -18,6 +18,19 @@ import { ChevronDownIcon } from 'lucide-react';
 import type { ComponentProps, ReactNode } from 'react';
 import { createContext, useContext, useEffect, useState } from 'react';
 
+const sanitizeUrl = (value: string | undefined | null): string | undefined => {
+  if (!value) return undefined;
+  try {
+    const url = new URL(value, typeof window !== 'undefined' ? window.location.origin : undefined);
+    if (url.protocol === 'http:' || url.protocol === 'https:') {
+      return url.toString();
+    }
+  } catch {
+    // Ignore invalid URLs
+  }
+  return undefined;
+};
+
 export interface WebPreviewContextValue {
   url: string;
   setUrl: (url: string) => void;
@@ -176,13 +189,14 @@ export const WebPreviewBody = ({
   ...props
 }: WebPreviewBodyProps) => {
   const { url } = useWebPreview();
+  const safeSrc = sanitizeUrl(src ?? url);
 
   return (
     <div className="flex-1">
       <iframe
         className={cn('size-full', className)}
         sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-presentation"
-        src={(src ?? url) || undefined}
+        src={safeSrc || undefined}
         title="Preview"
         {...props}
       />