element-hq / element-hq/element-web

Custom link text can be used for phishing

Open
#22,875 4 comments 6 reactions 0 assignees View on GitHub
A-URL-Previews O-Occasional Security T-Enhancement X-Needs-Design Z-Confidence-High
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Your use case

This is a continuation of https://github.com/vector-im/element-web/issues/6532

Since Element allows users to use markdown links, it's possible to make a link look like it leads to a different website than it actually does, for example:

```markdown
[good.com](evil.com)
```

### Have you considered any alternatives?

Some discussion has happened in https://github.com/vector-im/element-web/issues/6532 with some proposed solutions. The solution that seems to gather most consensus seems to be adding an alert like the one Thunderbird has:

![image](https://user-images.githubusercontent.com/5547783/179475651-bf9292e9-cd8c-485d-b927-9cb55f40b524.png)

Which it looks like Element iOS already implements according to https://github.com/vector-im/element-web/issues/6532#issuecomment-674825464

### Additional context

I wasn't sure what template to use to file this issue. The original issue was triaged as an enhancement request so I went for that, but feel free to fix the labels if it's wrong. Ideally https://github.com/vector-im/element-web/issues/6532 could just be reopened (it was closed by mistake by a PR that didn't actually fix it) but I'm told this would confuse processes in place.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.