[fzaninotto]

Problem

<UrlField> renders a record's field value directly as an anchor's href attribute with no scheme validation or sanitization. If the backing data source (a REST/GraphQL API, any data provider) returns a javascript: URI for that field instead of a URL, UrlField places it unmodified into the DOM. Clicking the rendered link executes it in the admin user's session. UrlField is documented purely as "displays a url," with no warning that the field value must be scheme-validated by the caller, unlike RichTextField's documented sanitization requirement.

Solution

Use a scheme detection function before putting the record field in the href prop.

If javascript: is detected, render an empty link and log an error in the console.

Closes #11408

Additional Checks

• The PR targets master for a bugfix or a documentation fix, or next for a feature
• The PR includes unit tests (if not possible, describe why)
• The PR includes one or several stories (if not possible, describe why)
• The documentation is up to date