A4 收口企业微信入口与通知回 OA

server/src/services/notifications/detailUrl.js

@@ -16,8 +16,8 @@ function buildDetailUrl(config, targetPath) {
     return null;
   }
 
-  if (path.startsWith('http://') || path.startsWith('https://')) {
-    return path;
+  if (/^[a-z][a-z0-9+.-]*:/i.test(path) || path.startsWith('//')) {
+    return null;
   }
 
   const normalizedPath = path.startsWith('/') ? path : `/${path}`;