Harden sanitizeUrl against percent-encoded bypasses and cover i18n trust pages

Decode percent-encoded characters and strip ASCII control characters
before protocol checking to block encoded dangerous protocols like
%6a%61%76%61%73%63%72%69%70%74 (javascript).

Add sanitizeUrl to repo.url hrefs in zh-cn, ko, and ja trust pages
so all data-driven URLs are consistently sanitized.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

src/lib/sanitize-url.ts

@@ -7,7 +7,19 @@ const allowedProtocols = new Set(['http:', 'https:', 'mailto:']);
  */
 export function sanitizeUrl(url: string): string {
   try {
-    const parsed = new URL(url, 'https://placeholder.invalid');
+    // Decode percent-encoded characters to catch encoded dangerous protocols
+    // like %6a%61%76%61%73%63%72%69%70%74 (javascript) or %64%61%74%61 (data)
+    let decoded = url;
+    try {
+      decoded = decodeURIComponent(url);
+    } catch {
+      // Malformed percent-encoding is fine; continue with the original
+    }
+
+    // Strip ASCII control characters that browsers silently remove
+    const cleaned = decoded.replace(/[\x00-\x1f\x7f]/g, '');
+
+    const parsed = new URL(cleaned, 'https://placeholder.invalid');
     return allowedProtocols.has(parsed.protocol) ? url : '#';
   } catch {
     return '#';

src/pages/trust/ja/index.astro

@@ -1,6 +1,7 @@
 ---
 import TrustTopbar from '../../../components/TrustTopbar.astro';
 import t from '../../../i18n/ja/trust.json';
+import { sanitizeUrl } from '../../../lib/sanitize-url';
 
 const isSubdomain = Astro.url.hostname === 'trust.openclaw.ai';
 const trustHref = isSubdomain ? '/ja' : '/trust/ja';
@@ -595,7 +596,7 @@ const langLinks = {
             <p>{t.phase4.reportBox.intro}</p>
             <ul style="margin-top: 12px; margin-bottom: 12px;">
               {t.phase4.reportBox.repos.map(repo => (
-                <li><strong>{repo.label}</strong> - <a href={repo.url}>{repo.name}</a></li>
+                <li><strong>{repo.label}</strong> - <a href={sanitizeUrl(repo.url)}>{repo.name}</a></li>
               ))}
             </ul>
             <p set:html={t.phase4.reportBox.fallback} />

src/pages/trust/ko/index.astro

@@ -1,6 +1,7 @@
 ---
 import TrustTopbar from '../../../components/TrustTopbar.astro';
 import t from '../../../i18n/ko/trust.json';
+import { sanitizeUrl } from '../../../lib/sanitize-url';
 
 const isSubdomain = Astro.url.hostname === 'trust.openclaw.ai';
 const trustHref = isSubdomain ? '/ko' : '/trust/ko';
@@ -602,7 +603,7 @@ const langLinks = {
             <p>{t.phase4.reportBox.intro}</p>
             <ul style="margin-top: 12px; margin-bottom: 12px;">
               {t.phase4.reportBox.repos.map((repo: { label: string; url: string; name: string }) => (
-                <li><strong>{repo.label}</strong> - <a href={repo.url}>{repo.name}</a></li>
+                <li><strong>{repo.label}</strong> - <a href={sanitizeUrl(repo.url)}>{repo.name}</a></li>
               ))}
             </ul>
             <p set:html={t.phase4.reportBox.fallback} />

src/pages/trust/zh-cn/index.astro

@@ -1,6 +1,7 @@
 ---
 import TrustTopbar from '../../../components/TrustTopbar.astro';
 import t from '../../../i18n/zh-cn/trust.json';
+import { sanitizeUrl } from '../../../lib/sanitize-url';
 
 const isSubdomain = Astro.url.hostname === 'trust.openclaw.ai';
 const trustHref = isSubdomain ? '/zh-cn' : '/trust/zh-cn';
@@ -595,7 +596,7 @@ const langLinks = {
             <p>{t.phase4.reportBox.intro}</p>
             <ul style="margin-top: 12px; margin-bottom: 12px;">
               {t.phase4.reportBox.repos.map(repo => (
-                <li><strong>{repo.label}</strong> - <a href={repo.url}>{repo.name}</a></li>
+                <li><strong>{repo.label}</strong> - <a href={sanitizeUrl(repo.url)}>{repo.name}</a></li>
               ))}
             </ul>
             <p set:html={t.phase4.reportBox.fallback} />