fix: reject unsafe TechLog network paths

src/features/tech-log/domain/content-format/parse-case-content.ts

@@ -185,9 +185,30 @@ function assertNever(value: never): never {
   throw new Error(`Unsupported content node: ${JSON.stringify(value)}`);
 }
 
+const trustedRelativeLinkOrigin = "https://techlog.invalid";
+
+function hasAsciiControlCharacter(value: string): boolean {
+  return Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint <= 0x1f || codePoint === 0x7f;
+  });
+}
+
 function isSafeLink(href: string): boolean {
+  if (href.includes("\\") || hasAsciiControlCharacter(href)) {
+    return false;
+  }
   if (href.startsWith("#")) return true;
-  if (href.startsWith("/")) return !href.startsWith("//");
+  if (href.startsWith("/")) {
+    try {
+      return (
+        new URL(href, `${trustedRelativeLinkOrigin}/`).origin ===
+        trustedRelativeLinkOrigin
+      );
+    } catch {
+      return false;
+    }
+  }
 
   try {
     const url = new URL(href);