fix security 1

static/js/note-files.js

@@ -3,6 +3,7 @@ import { copyText } from "@rustpad/clipboard";
 import { prepareImageFile } from "@rustpad/image-upload";
 import { askConfirm } from "@rustpad/modal";
 import { getAuthToken } from "@rustpad/session";
+import { safeAppUrl } from "@rustpad/security";
 
 function escapeHtml(value) {
   return String(value).replace(/[&<>"']/g, character => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#039;" }[character]));
@@ -63,7 +64,8 @@ export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, to
     form.append("file", file);
     try {
       const result = await api(endpoints.upload, { method: "POST", body: form, headers: {} });
-      const text = file.type.startsWith("image/") ? `![${file.name}](${result.url})` : `[${file.name}](${result.url})`;
+      const fileUrl = safeAppUrl(result.url);
+      const text = file.type.startsWith("image/") ? `![${file.name}](${fileUrl})` : `[${file.name}](${fileUrl})`;
       editor.setRangeText(text, editor.selectionStart, editor.selectionEnd, "end");
       editor.dispatchEvent(new Event("input", { bubbles: true }));
       toast("File uploaded");
@@ -80,7 +82,7 @@ export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, to
     if (showButton) {
       const panel = showButton.closest(".file-row").querySelector(".file-code");
       const output = panel.querySelector("textarea");
-      const absolute = new URL(showButton.dataset.url, location.origin).href;
+      const absolute = new URL(safeAppUrl(showButton.dataset.url), location.origin).href;
       let text = absolute;
       if (showButton.dataset.showFileCode === "markdown") text = showButton.dataset.mime?.startsWith("image/") ? `![${showButton.dataset.name}](${absolute})` : `[${showButton.dataset.name}](${absolute})`;
       output.value = text; panel.hidden = false; output.focus(); output.select(); return;