From ea58242b85f07c9aab2311458c25618398d02093 Mon Sep 17 00:00:00 2001
From: Nolan Lawson <nolan@nolanlawson.com>
Date: Sun, 11 Aug 2019 11:09:51 -0700
Subject: [PATCH] fix: fix malformed URLs in statuses (#1385)

fixes #1384
---
 src/routes/_components/status/StatusContent.html | 3 ++-
 src/routes/_utils/urlIsCrossOrigin.js            | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 src/routes/_utils/urlIsCrossOrigin.js

diff --git a/src/routes/_components/status/StatusContent.html b/src/routes/_components/status/StatusContent.html
index ecb4b3da..e96fe087 100644
--- a/src/routes/_components/status/StatusContent.html
+++ b/src/routes/_components/status/StatusContent.html
@@ -87,6 +87,7 @@
   import { store } from '../../_store/store'
   import { classname } from '../../_utils/classname'
   import { massageUserText } from '../../_utils/massageUserText'
+  import { urlIsCrossOrigin } from '../../_utils/urlIsCrossOrigin'
 
   export default {
     oncreate () {
@@ -141,7 +142,7 @@
           }
           // hydrate external links
           const href = anchor.getAttribute('href')
-          if (new URL(href, location.href).origin !== location.origin) {
+          if (urlIsCrossOrigin(href)) {
             anchor.setAttribute('title', href)
             anchor.setAttribute('target', '_blank')
             anchor.setAttribute('rel', 'nofollow noopener')
diff --git a/src/routes/_utils/urlIsCrossOrigin.js b/src/routes/_utils/urlIsCrossOrigin.js
new file mode 100644
index 00000000..5af4d9b8
--- /dev/null
+++ b/src/routes/_utils/urlIsCrossOrigin.js
@@ -0,0 +1,8 @@
+export function urlIsCrossOrigin (href) {
+  try {
+    return new URL(href, location.href).origin !== location.origin
+  } catch (e) {
+    console.error('Ignoring malformed URL', href)
+    return true
+  }
+}