fix security 1

static/js/workspace.js

@@ -6,6 +6,7 @@ import { copyText } from "@rustpad/clipboard";
 import { getNickname, getAccessToken, getAuthToken, setAccessToken } from "@rustpad/session";
 import { bindIdentityDialog, validateCurrentSession } from "@rustpad/auth-ui";
 import { askConfirm } from "@rustpad/modal";
+import { safeAppUrl } from "@rustpad/security";
 
 const parts = location.pathname.split("/").filter(Boolean);
 const slug = parts[1];
@@ -64,7 +65,7 @@ function renderNotes(notes = notesCache) {
   if (notesView === "table") {
     notesList.innerHTML = `<div class="notes-table-scroll"><table><thead><tr><th>Name</th><th>Created by</th><th>Status</th><th>Updated</th><th class="notes-table-actions">Actions</th></tr></thead><tbody>${notes.map(note => `
       <tr>
-        <td><a class="note-table-link" href="${note.url}?view=split&mode=markdown">${escapeHtml(note.title)}</a></td>
+        <td><a class="note-table-link" href="${escapeHtml(safeAppUrl(`${note.url}?view=split&mode=markdown`))}">${escapeHtml(note.title)}</a></td>
         <td class="note-author">${escapeHtml(note.created_by || "Unknown")}</td>
         <td>${note.protected ? '<span class="protect-badge">Protected</span>' : '<span class="note-status">Unprotected</span>'}</td>
         <td>${formatDate(note.updated_at)}</td>
@@ -74,7 +75,7 @@ function renderNotes(notes = notesCache) {
   }
   notesList.innerHTML = notes.map(note => `
     <article class="note-card-wrap">
-      <a class="note-card" href="${note.url}?view=split&mode=markdown">
+      <a class="note-card" href="${escapeHtml(safeAppUrl(`${note.url}?view=split&mode=markdown`))}">
         <div class="note-card-title"><h3>${escapeHtml(note.title)}</h3>${note.protected ? '<span class="protect-badge">Protected</span>' : ''}</div>
         <div class="note-card-meta"><span>Created by: ${escapeHtml(note.created_by || "Unknown")}</span><span>Updated: ${formatDate(note.updated_at)}</span></div>
       </a>
@@ -134,7 +135,7 @@ document.querySelector("#note-form").addEventListener("submit", async e => {
       method: "POST",
       body: JSON.stringify({ name: document.querySelector("#note-name").value, access_token: accessToken || null, protect: document.querySelector("#note-protect").checked, created_by: nickname || null })
     });
-    location.assign(`${note.url}?view=split&mode=markdown`);
+    location.assign(safeAppUrl(`${note.url}?view=split&mode=markdown`));
   } catch (err) { error.textContent = err.message; }
 });
 notesList.addEventListener("click", async event => {