From 9a443a06e3a45f8e6a1001241685baa517d511b4 Mon Sep 17 00:00:00 2001
From: Kenji Saito <1867845+poad@users.noreply.github.com>
Date: Thu, 1 Jan 2026 18:33:34 +0900
Subject: [PATCH] Potential fix for code scanning alert no. 3: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 chat-app/components/ai-elements/web-preview.tsx | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/chat-app/components/ai-elements/web-preview.tsx b/chat-app/components/ai-elements/web-preview.tsx
index 0f14ad67..21679f54 100644
--- a/chat-app/components/ai-elements/web-preview.tsx
+++ b/chat-app/components/ai-elements/web-preview.tsx
@@ -18,6 +18,19 @@ import { ChevronDownIcon } from 'lucide-react';
 import type { ComponentProps, ReactNode } from 'react';
 import { createContext, useContext, useEffect, useState } from 'react';
 
+const sanitizeUrl = (value: string | undefined | null): string | undefined => {
+  if (!value) return undefined;
+  try {
+    const url = new URL(value, typeof window !== 'undefined' ? window.location.origin : undefined);
+    if (url.protocol === 'http:' || url.protocol === 'https:') {
+      return url.toString();
+    }
+  } catch {
+    // Ignore invalid URLs
+  }
+  return undefined;
+};
+
 export interface WebPreviewContextValue {
   url: string;
   setUrl: (url: string) => void;
@@ -176,13 +189,14 @@ export const WebPreviewBody = ({
   ...props
 }: WebPreviewBodyProps) => {
   const { url } = useWebPreview();
+  const safeSrc = sanitizeUrl(src ?? url);
 
   return (
     <div className="flex-1">
       <iframe
         className={cn('size-full', className)}
         sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-presentation"
-        src={(src ?? url) || undefined}
+        src={safeSrc || undefined}
         title="Preview"
         {...props}
       />