fix: Implement URL sanitization for DEX and website links

[odaysec]

Added a sanitizeHref function to validate and sanitize URLs before use.

Extracting text from a DOM node and interpreting it as HTML can lead to a cross-site scripting vulnerability. A webpage with this vulnerability reads text from the DOM, and afterwards adds the text as HTML to the DOM. Using text from the DOM as HTML effectively unescapes the text, and thereby invalidates any escaping done on the text. If an attacker is able to control the safe sanitized text, then this vulnerability can be exploited to perform a cross-site scripting attack.

In general, untrusted strings used in URL contexts should be validated and normalized before being placed in href or similar attributes. Specifically, you should only allow safe URL schemes (http:, https: – optionally others like mailto: if needed) and reject or neutralize dangerous schemes like javascript:, data:, vbscript:, etc. This can be done either where input is accepted (sanitizing websiteUrl before storing it) or at the point of use (sanitizing broker.dexUrl before rendering it).

The least intrusive and most robust fix here is to introduce a small URL-cleaning helper in DexCard.tsx and use it around broker.dexUrl (and, for consistency/safety, around broker.websiteUrl too) before they are passed to href. The helper should:

• Accept a string | null | undefined.
• If falsy, return "#" (the current safe fallback).
• Attempt to construct a new URL() either with the string as-is (absolute) or relative to window.location.origin when in the browser (to handle inputs like "/path"). If parsing fails, fall back to "#".
• Check that the resulting url.protocol is in an allowed list (e.g., http: and https:). If not, fall back to "#".

This keeps existing behavior for valid HTTP(S) URLs and relative paths, while preventing javascript: or other malicious schemes from being used. Implementation-wise:

• In app/app/components/DexCard.tsx, define sanitizeHref above the component.
• Replace href={broker.dexUrl || "#"} with href={sanitizeHref(broker.dexUrl)}.
• Replace href={broker.websiteUrl} with href={sanitizeHref(broker.websiteUrl)}.