Add hostname label

src-ui/src/app/components/chat/chat/chat.component.spec.ts

@@ -221,4 +221,19 @@ describe('ChatComponent', () => {
     expect(el.querySelector('.chat-markdown script')).toBeNull()
     expect(el.textContent).toContain('**user**')
   })
+
+  it('should keep the destination hostname visible after sanitizing chat links', () => {
+    component.messages.set([
+      {
+        role: 'assistant',
+        content:
+          '[View original document](https://otherdomain.example/?data=secret)',
+      },
+    ])
+    fixture.detectChanges()
+    const el: HTMLElement = fixture.nativeElement
+    const link = el.querySelector('.chat-markdown a')
+    expect(link?.textContent).toBe('View original document')
+    expect(link?.nextElementSibling?.textContent).toBe('(otherdomain.example)')
+  })
 })

src-ui/src/app/pipes/markdown.pipe.spec.ts

@@ -31,9 +31,11 @@ describe('MarkdownPipe', () => {
   })
 
   it('should not render images', () => {
-    const html = pipe.transform('![secret](https://evil.example/x.png?d=1)')
+    const html = pipe.transform(
+      '![secret](https://otherdomain.example/x.png?d=1)'
+    )
     expect(html).not.toContain('<img')
-    expect(html).not.toContain('evil.example')
+    expect(html).not.toContain('otherdomain.example')
     expect(html).toContain('secret')
   })
 
@@ -61,6 +63,24 @@ describe('MarkdownPipe', () => {
     }
   })
 
+  it('should show the actual hostname beside web links with misleading labels', () => {
+    for (const protocol of ['http', 'https']) {
+      const html = pipe.transform(
+        `[docs.paperless-ngx.com](${protocol}://docs.paperless-ngx.com@otherdomain.example/path?secret=1)`
+      )
+      expect(html).toContain(
+        '</a> <span class="text-muted small">(otherdomain.example)</span>'
+      )
+      expect(html).not.toContain('(docs.paperless-ngx.com)')
+    }
+  })
+
+  it('should omit the hostname label for mailto links', () => {
+    expect(pipe.transform('[mail](mailto:a@b.c)')).toBe(
+      '<p><a href="mailto:a@b.c" target="_blank" rel="noopener noreferrer nofollow">mail</a></p>\n'
+    )
+  })
+
   it('should escape link titles', () => {
     const html = pipe.transform(
       '[x](https://a.example "a\\" onmouseover=\\"1")'

src-ui/src/app/pipes/markdown.pipe.ts

@@ -35,7 +35,11 @@ const renderer: Partial<Renderer> = {
     const url = safeHref(href)
     if (!url) return text
     const titleAttr = title ? ` title="${escapeHtml(title)}"` : ''
-    return `<a href="${escapeHtml(url)}"${titleAttr} target="_blank" rel="noopener noreferrer nofollow">${text}</a>`
+    const hostname = new URL(url).hostname
+    const hostnameLabel = hostname
+      ? ` <span class="text-muted small">(${escapeHtml(hostname)})</span>`
+      : ''
+    return `<a href="${escapeHtml(url)}"${titleAttr} target="_blank" rel="noopener noreferrer nofollow">${text}</a>${hostnameLabel}`
   },
 }