[Bug]: isAllowedURI disregards custom protocols

[Nantris]

Affected Packages

extension-link

Version(s)

2.5.9

Bug Description

The link extension accepts custom protocols, but then it rejects them anyway since the XSS fix: https://github.com/ueberdosis/tiptap/blob/84febb29c7092ba0393af78fb44be29e0befa3f4/packages/extension-link/src/link.ts#L112C9-L114C1

Browser Used

Chrome

Code Example URL

No response

Expected Behavior

Custom protocols should be allowed - eg file:// is necessary in our case.

Additional Context (Optional)

No response

Dependency Updates

• Yes, I've updated all my dependencies.

[Nantris]

Suggest change: Make isAllowedURI accept a custom checker function to use in addition to the default logic (not instead of it.)

[nperez0111]

Good catch, I think that we need to respect the protocols that have been allowed.
Maybe, if there is need for a custom checker function we can add it later, but the current bug is that it is not respecting the protocols option.

[rfgamaral]

@nperez0111 Same as this one, latest releases says this is fixed, but issue is still opened.

[nperez0111]

Yep this is resolved

[Nantris]

I think a custom checker function would be better. This approach still disallows our custom links if they don't start with a protocol (they're transformed to include protocols elsewhere in our code, since we control the execution environment) and it forces inclusion of unsupported protocols - we don't support cid, xmpp, etc

We still have to patch in ~50 lines, essentially copied from @tiptap/link-extension, to allow our links to work.

It's not feasible for us to adapt to the current approach. I understand if you feel this is not worth implementing, but it's disappointing to have to duplicate 50 lines of code just to add an ability to pass a custom checker function (2 lines of code.)

[nperez0111]

Appreciate the concern here @Nantris if you like could you create a PR to see that this is addressed?

Obviously my main concern was fixing the regression so I prioritized that. Now that we have that fixed we can figure out the better solution. It is already strange with a validate function and custom protocol handling I do feel a custom checker is in order with some of our changes as a default that can be overriden or something

[Nantris]

Thanks for the reply @nperez0111! I'll be happy to do so. It's not a high priority right now since I'm running behind on other things, but I'd love to eliminate the code duplication so I'll definitely loop back on this!