fix: a security issue related to open external (#13864)

packages/frontend/core/src/modules/url/services/url.ts

@@ -39,6 +39,16 @@ export class UrlService extends Service {
    * @param url only full url with http/https protocol is supported
    */
   openExternal(url: string) {
+    let parsed: URL;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new Error(`Invalid external URL: ${url}`);
+    }
+
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      throw new Error('only http/https URLs are supported');
+    }
     if (BUILD_CONFIG.isWeb || BUILD_CONFIG.isMobileWeb) {
       location.href = url;
     } else {