fix(editor): Sanitize unsafe URL schemes in paste and link rendering#3218

Draft

bukinoshita wants to merge 2 commits intocanaryfrom

fix/sanitize-unsafe-link-schemes-3208

Commits on Apr 9, 2026

fix(editor): sanitize unsafe URL schemes (javascript:, data:, vbscript:) in paste and link rendering

cursoragent
and
bukinoshita
committed
fix(editor): use scheme extraction with set lookup to satisfy CodeQL

cursoragent
and
bukinoshita
committed