element-hq / element-hq/element-android

Unable to see real URL/link destination

Open
#8,523 0 comments 0 reactions 0 assignees View on GitHub
A-Links O-Occasional S-Minor Security T-Defect
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

### Steps to reproduce

1. When a renamed URL (ex: [https://google.com](https://example.com)) is sent, there is no way to see the real destination of the link.
2. Clicking and holding copies the destination, where it can be inspected, but that requires pasting the link into chat or leaving the app.

### Outcome

#### What did you expect?
A popup similar to Discord to show the real destination would be safer for users. The ambiguity between a normal link and a renamed link mean every link is potentially malicious and needs to be checked before navigating to it.
![image](https://github.com/vector-im/element-android/assets/7216500/a5399f42-87a7-4957-887e-62c7052d55b9)
#### What happened instead?
The real, potentially malicious link, opens in a browser.

### Your phone model

_No response_

### Operating system version

_No response_

### Application version and app store

Element 1.5.32 [40105322] (G-8dcb5f70)

### Homeserver

_No response_

### Will you send logs?

No

### Are you willing to provide a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.