From e7ce67168cf22b91381e297d985bdfde1e0ddaf9 Mon Sep 17 00:00:00 2001
From: Anna Larch <anna@nextcloud.com>
Date: Tue, 14 Apr 2026 22:37:28 +0200
Subject: [PATCH] fix(notifications): Require absolute links for support of
 desktop and mobile clients

To align with the stricter validation introduced in nextcloud/server#59606.

AI-Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
---
 lib/NotificationGenerator.php | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/lib/NotificationGenerator.php b/lib/NotificationGenerator.php
index 43dfc6d1b..705a9b92c 100644
--- a/lib/NotificationGenerator.php
+++ b/lib/NotificationGenerator.php
@@ -31,6 +31,14 @@ public function __construct(
 	) {
 	}
 
+	private function sanitizeUrl(string $url): string {
+		if (str_starts_with($url, 'http://') || str_starts_with($url, 'https://')) {
+			return $url;
+		}
+
+		return '';
+	}
+
 	public function deferNotifications(): bool {
 		return $this->notificationManager->defer();
 	}
@@ -68,8 +76,9 @@ private function getNotificationForEvent(IEvent $event, int $activityId): INotif
 			$notification->setMessage($event->getMessage(), $event->getMessageParameters());
 		}
 
-		if ($event->getLink()) {
-			$notification->setLink($event->getLink());
+		$link = $event->getLink() ? $this->sanitizeUrl($event->getLink()) : '';
+		if ($link !== '') {
+			$notification->setLink($link);
 		}
 
 		return $notification;
@@ -128,8 +137,9 @@ private function getDisplayNotificationForEvent(IEvent $event, int $activityId):
 		$notification->setRichSubject($event->getRichSubject(), $event->getRichSubjectParameters());
 		$notification->setParsedSubject($event->getParsedSubject());
 
-		if ($event->getIcon()) {
-			$notification->setIcon($event->getIcon());
+		$icon = $event->getIcon() ? $this->sanitizeUrl($event->getIcon()) : '';
+		if ($icon !== '') {
+			$notification->setIcon($icon);
 		}
 
 		if ($event->getRichMessage()) {