OpenURL: security implications

[nephros]

So, with #11 merged, Users can be presented a link to hxxp://matrix.to/ and the "open with" dialog will pass it to Hydrogen.

Question: are we able to blacklist/whitelist valid URLs that may be set this way? Because now, such URLs will be set to the (authorized/logged-in!) view without looking at them, which could be used maliciously.

Maybe the handleUrlChange() function can be expanded too look at URLs closer, and not only detect invitations, but also filter not-allowed URLs or so.

[pherjung]

If the only issue is changing the protocol, we can create an URL object in JS and check the protocol. This would be done in the openUrl function.