🔒 [Security Fix] Prevent DOM XSS in git commit URL (#40)

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: sunnylqm <615282+sunnylqm@users.noreply.github.com>

Author: sunnylqm

src/pages/manage/components/commit.tsx

@@ -36,6 +36,18 @@ export const Commit = ({ commit }: { commit?: Commit }) => {
     }
   }
 
+  // Validate URL protocol to prevent XSS
+  if (url) {
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        url = '';
+      }
+    } catch {
+      url = '';
+    }
+  }
+
   const time = dayjs(+commit.timestamp * 1000);
 
   return (