Validate url schema

src/ui/components/Markup/Markup.tsx

@@ -1,5 +1,6 @@
 import React from 'react';
 
+import {sanitizeUrl} from '@braintree/sanitize-url';
 import {Link} from '@gravity-ui/uikit';
 import merge from 'lodash/merge';
 
@@ -97,10 +98,11 @@ const getConfig = (
             break;
         }
         case MarkupItemTypes.Url: {
+            const href = sanitizeUrl(markupItem.url || '');
             iteratedConfigItem.element = Link as TemplateItem['element'];
             iteratedConfigItem.props = merge(iteratedConfigItem.props, {
                 view: 'normal',
-                href: markupItem.url || '',
+                href,
                 target: '_blank',
             });
             break;

src/ui/libs/DatalensChartkit/ChartKit/helpers/apply-hc-handlers.ts

@@ -1,3 +1,4 @@
+import {sanitizeUrl} from '@braintree/sanitize-url';
 import type {Highcharts} from '@gravity-ui/chartkit/highcharts';
 import {pickActionParamsFromParams} from '@gravity-ui/dashkit/helpers';
 import {wrap} from 'highcharts';
@@ -7,7 +8,6 @@ import merge from 'lodash/merge';
 import set from 'lodash/set';
 
 import type {GoToEventHandler, GraphWidgetEventScope} from '../../../../../shared';
-import {validateUrl} from '../../modules/html-generator/utils';
 import type {GraphWidget} from '../../types';
 import type {ChartKitAdapterProps} from '../types';
 
@@ -167,8 +167,8 @@ function handleSeriesClickForGoTo(args: {
     }
 
     try {
-        validateUrl(pointUrl);
-        window.open(pointUrl, target === '_self' ? '_self' : '_blank');
+        const url = sanitizeUrl(pointUrl);
+        window.open(url, target === '_self' ? '_self' : '_blank');
     } catch (e) {
         console.error(e);
     }

src/ui/libs/DatalensChartkit/modules/data-provider/charts/ui-sandbox.ts

@@ -1,3 +1,4 @@
+import {sanitizeUrl} from '@braintree/sanitize-url';
 import type {PointOptionsType} from 'highcharts';
 import escape from 'lodash/escape';
 import get from 'lodash/get';
@@ -19,7 +20,7 @@ import {
 import Performance from '../../../ChartKit/modules/perfomance';
 import type {UiSandboxRuntimeOptions} from '../../../types';
 import {generateHtml} from '../../html-generator';
-import {getParseHtmlFn, validateUrl} from '../../html-generator/utils';
+import {getParseHtmlFn} from '../../html-generator/utils';
 
 import {UiSandboxRuntime} from './ui-sandbox-runtime';
 
@@ -243,8 +244,8 @@ async function getUnwrappedFunction(args: {
             window: {
                 open: function (url: string, target?: string) {
                     try {
-                        validateUrl(url);
-                        window.open(url, target === '_self' ? '_self' : '_blank');
+                        const href = sanitizeUrl(url);
+                        window.open(href, target === '_self' ? '_self' : '_blank');
                     } catch (e) {
                         console.error(e);
                     }

src/ui/libs/DatalensChartkit/modules/html-generator/utils.ts

@@ -1,3 +1,4 @@
+import {sanitizeUrl} from '@braintree/sanitize-url';
 import escape from 'lodash/escape';
 import isObject from 'lodash/isObject';
 import type {ChartKitHtmlItem} from 'shared';
@@ -7,7 +8,8 @@ import {ChartKitCustomError} from '../../ChartKit/modules/chartkit-custom-error/
 import {ALLOWED_REFERENCES, ATTR_DATA_CE_THEME, THEME_CSS_VARIABLE_PREFIX} from './constants';
 
 export function validateUrl(url: string, errorMsg?: string) {
-    if (!ALLOWED_REFERENCES.some((ref) => String(url).startsWith(ref))) {
+    const href = sanitizeUrl(url);
+    if (!ALLOWED_REFERENCES.some((ref) => href.startsWith(ref))) {
         const msg = errorMsg ?? `'${url}' is not valid url`;
         throw new ChartKitCustomError(undefined, {
             message: msg,