fix-click-chat-messege

[Sayan-pixel]

Summary

Implemented support for clickable URLs in chat messages.

• Detects only http:// and https:// URLs in decrypted chat messages.
• Converts detected URLs into clickable links.
• Escapes all non-URL text before rendering to prevent HTML injection.
• Opens links in a new tab using target="_blank".
• Adds rel="noopener noreferrer" for improved security.
• Sanitizes the generated HTML before binding it to the template.
• Keeps all non-URL message content as plain text.

Linked issue

Closes #302

How to test

1. Start the frontend.
2. Open a private chat.
3. Send the following messages:
   • Hello World
   • https://google.com
   • Visit https://github.com/Vault-Web
   • https://google.com https://openai.com
   • ftp://example.com
   • <script>alert(1)</script>
4. Verify:
   • Only http:// and https:// URLs are clickable.
   • Links open in a new tab.
   • All other text remains plain text.
   • HTML/script tags are displayed as text and are not executed.

Notes / Risk

• The change is limited to plain URL detection as described in the issue.
• Markdown and arbitrary HTML rendering are intentionally not supported to minimize the attack surface.
• The generated HTML is sanitized before rendering for additional protection against XSS.

[DenizAltunkapan]

@Sayan-pixel please fix the failing workflows

[Sayan-pixel]

Summary

URLs sent in chat messages are now rendered as clickable links that open in a new tab. Only http:// and https:// schemes are linkified — everything else stays as plain text. No full Markdown or HTML parsing is introduced.

Problem

The message bubble rendered decrypted content using Angular interpolation ({{ msg.content }}), which escapes the value into plain text. Recipients had to manually select and copy URLs to visit them.

Solution

Layer | Change -- | -- Template | Replaced {{ msg.content }} with [innerHTML]="formatMessage(msg.content)" Detection | formatMessage() uses a regex to find http:// and https:// URLs in the decrypted text Link generation | Each URL is wrapped in  Escaping | Every text segment is HTML-escaped via escapeHtml(); the URL is escaped in both href and display text Sanitisation | The assembled HTML is sanitised with DOMPurify (same library used by the cloud page's Markdown preview) Trailing punctuation | Trailing .,;:!?) is stripped from matched URLs so "visit https://example.com." links correctly Styling | Scoped ::ng-deep CSS makes links underlined and inherit the bubble's text color