mirror of
https://github.com/HeyPuter/firefox.git
synced 2026-11-13 20:14:57 -10:00
Randy Concepcion
88a153a126
Implements push-based URL security validation for AI Window. The parent process pushes a trusted URL list to the child whenever the conversation's security ledger changes (e.g., user @mentions a tab). ai-chat-message validates anchors synchronously during render against this list. Trusted URLs become clickable, others will be unclickable/plaintext (fail-closed). This validates the actual rendered DOM rather than raw LLM text, avoiding parser disagreement between markdown-to-HTML and regex-based extraction. Differential Revision: https://phabricator.services.mozilla.com/D280039