GitHub

`openUrl` permits `javascript:` URI execution via agent-supplied button actions

0.9.0, 0.9.1, 0.9.2, 0.10.0, 0.10.1 ...
GitHub

[Javascript][Rendering/Templating] Invalid Action.OpenUrl url parameter can break card render on desktop Teams #4655

JavaScript Author or host Teams Version of SDK 1.2.3 Details Previously when an invalid URL was passed to the Action.OpenUrl action (e.g. because invalid input was passed by a user from previous ...