From 6bdee93727cc2ac58d421c807fecc1209963576f Mon Sep 17 00:00:00 2001
From: Guilherme Gazzo <guilherme@gazzo.xyz>
Date: Mon, 25 May 2026 18:38:52 -0300
Subject: [PATCH] fix: validate src URL scheme in composer preview popup

ComposerBoxPopupPreview rendered `item.value` directly into the `src`
attribute of `<img>`, `<audio>`, and `<video>` tags without scheme
validation. If `/v1/commands.preview` ever returned a `javascript:`
(or other non-media) URI, the unsafe value would land in the DOM.

Add a scheme allowlist (`http`, `https`, `data`, `blob`); skip the
media element when the value fails validation.
---
 .changeset/composer-preview-src-validation.md |  5 ++
 .../room/composer/ComposerBoxPopupPreview.tsx | 83 +++++++++++--------
 2 files changed, 54 insertions(+), 34 deletions(-)
 create mode 100644 .changeset/composer-preview-src-validation.md

diff --git a/.changeset/composer-preview-src-validation.md b/.changeset/composer-preview-src-validation.md
new file mode 100644
index 0000000000000..c29ab88d781e1
--- /dev/null
+++ b/.changeset/composer-preview-src-validation.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Validate `src` URL scheme in the slash command composer preview popup. The `ComposerBoxPopupPreview` component now ignores preview media values that do not resolve to an `http`, `https`, `data`, or `blob` URL, blocking `javascript:` (and other non-media) URIs returned by `/v1/commands.preview`.
diff --git a/apps/meteor/client/views/room/composer/ComposerBoxPopupPreview.tsx b/apps/meteor/client/views/room/composer/ComposerBoxPopupPreview.tsx
index dfa02a7829945..691cc13206235 100644
--- a/apps/meteor/client/views/room/composer/ComposerBoxPopupPreview.tsx
+++ b/apps/meteor/client/views/room/composer/ComposerBoxPopupPreview.tsx
@@ -9,6 +9,17 @@ import { useChat } from '../contexts/ChatContext';
 
 type ComposerBoxPopupPreviewItem = { _id: string; type: 'image' | 'video' | 'audio' | 'text' | 'other'; value: string; sort?: number };
 
+const SAFE_MEDIA_SCHEMES = new Set(['http:', 'https:', 'data:', 'blob:']);
+
+const safeMediaSrc = (value: string): string | undefined => {
+	try {
+		const { protocol } = new URL(value, window.location.origin);
+		return SAFE_MEDIA_SCHEMES.has(protocol) ? value : undefined;
+	} catch {
+		return undefined;
+	}
+};
+
 type ComposerBoxPopupPreviewProps = ComposerBoxPopupProps<ComposerBoxPopupPreviewItem> & {
 	title?: ReactNode;
 	rid: string;
@@ -119,40 +130,44 @@ const ComposerBoxPopupPreview = forwardRef(function ComposerBoxPopupPreview(
 								.map((_, index) => <Skeleton variant='rect' h='100px' w='120px' m={2} key={index} />)}
 
 						{!isLoading &&
-							itemsFlat.map((item) => (
-								<Box
-									onClick={() => select(item)}
-									role='option'
-									className={['popup-item', item === focused && 'selected'].filter(Boolean).join(' ')}
-									id={`popup-item-${item._id}`}
-									key={item._id}
-									bg={item === focused ? 'selected' : undefined}
-									borderColor={item === focused ? 'highlight' : 'transparent'}
-									tabIndex={item === focused ? 0 : -1}
-									aria-selected={item === focused}
-									m={2}
-									borderWidth='default'
-									borderRadius='x4'
-								>
-									{item.type === 'image' && <img src={item.value} alt={item._id} />}
-									{item.type === 'audio' && (
-										<audio controls>
-											<track kind='captions' />
-											<source src={item.value} />
-											Your browser does not support the audio element.
-										</audio>
-									)}
-									{item.type === 'video' && (
-										<video controls className='inline-video'>
-											<track kind='captions' />
-											<source src={item.value} />
-											Your browser does not support the video element.
-										</video>
-									)}
-									{item.type === 'text' && <Option>{item.value}</Option>}
-									{item.type === 'other' && <code>{item.value}</code>}
-								</Box>
-							))}
+							itemsFlat.map((item) => {
+								const mediaSrc =
+									item.type === 'image' || item.type === 'audio' || item.type === 'video' ? safeMediaSrc(item.value) : undefined;
+								return (
+									<Box
+										onClick={() => select(item)}
+										role='option'
+										className={['popup-item', item === focused && 'selected'].filter(Boolean).join(' ')}
+										id={`popup-item-${item._id}`}
+										key={item._id}
+										bg={item === focused ? 'selected' : undefined}
+										borderColor={item === focused ? 'highlight' : 'transparent'}
+										tabIndex={item === focused ? 0 : -1}
+										aria-selected={item === focused}
+										m={2}
+										borderWidth='default'
+										borderRadius='x4'
+									>
+										{item.type === 'image' && mediaSrc && <img src={mediaSrc} alt={item._id} />}
+										{item.type === 'audio' && mediaSrc && (
+											<audio controls>
+												<track kind='captions' />
+												<source src={mediaSrc} />
+												Your browser does not support the audio element.
+											</audio>
+										)}
+										{item.type === 'video' && mediaSrc && (
+											<video controls className='inline-video'>
+												<track kind='captions' />
+												<source src={mediaSrc} />
+												Your browser does not support the video element.
+											</video>
+										)}
+										{item.type === 'text' && <Option>{item.value}</Option>}
+										{item.type === 'other' && <code>{item.value}</code>}
+									</Box>
+								);
+							})}
 					</Box>
 				</Box>
 			</Tile>