fix: final review wave — public routes, inbox 419, url schemes, deep_link, tests

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw
2026-09-04 09:09:07 -03:00
parent dd714a4be1
commit cbb43714ae
20 changed files with 123 additions and 20 deletions
--- a/core/app/Http/Controllers/InboxController.php
+++ b/core/app/Http/Controllers/InboxController.php
@@ -91,7 +91,7 @@ class InboxController extends Controller
    /** Пропускает только относительные пути и http(s)-ссылки; прочее (напр. javascript:) отбрасывает. */
    public static function safeLink(?string $link): ?string
    {
-        return $link !== null && preg_match('#^(/(?!/)|https?://)#i', $link) === 1 ? $link : null;
+        return $link !== null && preg_match('#^(/(?![/\\\\])|https?://)#i', $link) === 1 ? $link : null;
    }

    public static function relative(int $diff): string