fix(extension-link): use whitelist for allowed href values

[chroth]

Changes Overview

Link href values needs to be sanitized to not result in XSS vulnerabilities.

Implementation Approach

Link href values only allows whitelisted patterns for url, that are known to not be dangerous.

Testing Done

The link extension spec has been updated to cover both positive and negative tests.

Verification Steps

Link extension still functions as expected when testing with valid links, such as relative, absolute, with different schemes etc.

Additional Notes

Checklist

• I have renamed my PR according to the naming conventions. (e.g. feat: Implement new feature or chore(deps): Update dependencies)
• My changes do not break the library.
• I have added tests where applicable.
• I have followed the project guidelines.
• I have fixed any lint issues.

Related Issues

[netlify]

✅ Deploy Preview for tiptap-embed ready!

Name	Link
🔨 Latest commit	738c436
🔍 Latest deploy log	https://app.netlify.com/sites/tiptap-embed/deploys/664621edbbeefb000876bcd3
😎 Deploy Preview	https://deploy-preview-5160--tiptap-embed.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[nperez0111]

Thanks for your contribution @chroth I've went ahead and added a couple more tests and merged some of the changes from #5157

Thank you as well @Nantris for your contribution here.

[Nantris]

Thanks to all for their work on this. Based on the code I imagine that this properly prevents javascript: hrefs. I'd submit a PR to add that test case but I'm not 100% clear that simply adding that line would work properly (eg after this line https://github.com/chroth/tiptap/blob/738c436a9ff4af39d1d6abd52208eb7d46616106/tests/cypress/integration/extensions/link.spec.ts#L186)

Is this (or will this be) backported to older versions?

[Nantris]

Can anyone advise whether this will be backported? I understand the desire is probably not to continue maintaining older versions, but with this being a security issue and a number of outstanding issues blocking upgrade paths, I think it should be planned to be backported at least a few versions.