fix: reject unsafe TechLog network paths

tests/features/tech-log/content-format.test.ts

@@ -39,6 +39,11 @@ describe("Content Format v1", () => {
       "<script>alert(1)</script>",
       "[x](javascript:alert(1))",
       "[x](//evil.example/path)",
+      "[x](/\\evil.example/path)",
+      "[x](/\\\\evil.example/path)",
+      "[x](</safe\u0001path>)",
+      "[x](</safe\u001fpath>)",
+      "[x](</safe\u007fpath>)",
       "- outer\n  - nested",
       "# level one",
       "- [ ] task",
@@ -68,6 +73,26 @@ describe("Content Format v1", () => {
     }
   });
 
+  it("keeps explicitly allowed links and same-origin paths", () => {
+    const [paragraph] = parseCaseContent(
+      "[fragment](#section) [path](/safe/path?q=one) [http](http://example.com/path) [https](https://example.com/path) [mail](mailto:test@example.com)",
+    );
+
+    expect(paragraph?.type).toBe("PARAGRAPH");
+    if (paragraph?.type !== "PARAGRAPH") return;
+    expect(
+      paragraph.content
+        .filter((inline) => inline.type === "LINK")
+        .map((inline) => inline.href),
+    ).toEqual([
+      "#section",
+      "/safe/path?q=one",
+      "http://example.com/path",
+      "https://example.com/path",
+      "mailto:test@example.com",
+    ]);
+  });
+
   it("generates stable Korean heading IDs and suffixes duplicates", () => {
     const blocks = parseCaseContent("## 한글 API!\n\n## 한글 API?\n\n## !!!");