element-hq / element-hq/element-web
Custom link text can be used for phishing
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Your use case
This is a continuation of https://github.com/vector-im/element-web/issues/6532
Since Element allows users to use markdown links, it's possible to make a link look like it leads to a different website than it actually does, for example:
```markdown
[good.com](evil.com)
```
### Have you considered any alternatives?
Some discussion has happened in https://github.com/vector-im/element-web/issues/6532 with some proposed solutions. The solution that seems to gather most consensus seems to be adding an alert like the one Thunderbird has:

Which it looks like Element iOS already implements according to https://github.com/vector-im/element-web/issues/6532#issuecomment-674825464
### Additional context
I wasn't sure what template to use to file this issue. The original issue was triaged as an enhancement request so I went for that, but feel free to fix the labels if it's wrong. Ideally https://github.com/vector-im/element-web/issues/6532 could just be reopened (it was closed by mistake by a PR that didn't actually fix it) but I'm told this would confuse processes in place.
Contributor guide
Assessment
This issue has not been assessed yet.