{"record":{"id":"7acae9a302056e76","repo":"Foundry376/Mailspring","slug":"invalid-url","errorCode":null,"errorMessage":"Invalid URL","messagePattern":"Invalid URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/internal_packages/list-unsubscribe/lib/unsubscribe-service.ts","lineNumber":157,"sourceCode":"    throw new Error('Invalid mailto URI');\n  }\n\n  // Use the application's openUrl handler which routes to DraftStore._onHandleMailtoLink\n  // This creates a draft and opens it in the composer for user review\n  const sanitizedUri = encodeURI(decodeURI(mailtoUri));\n  require('@electron/remote').getGlobal('application').openUrl(sanitizedUri);\n}\n\n/**\n * Opens the unsubscribe URL in the user's default browser.\n *\n * This is used as a fallback when one-click is not available.\n *\n * @param url - The HTTP/HTTPS URL to open\n */\nexport function performWebUnsubscribe(url: string): void {\n  if (!/^https?:\\/\\/.+/i.test(url)) {\n    throw new Error('Invalid URL');\n  }\n  shell.openExternal(url);\n}\n\n/**\n * Determines the best unsubscribe method based on available options.\n *\n * Priority order:\n * 1. One-click HTTPS (if List-Unsubscribe-Post header present) - instant, no user interaction\n * 2. Mailto - opens composer for user review\n * 3. Regular HTTPS/HTTP - opens in browser\n *\n * @param options - Parsed unsubscribe options from the header\n * @param hasOneClickSupport - Whether List-Unsubscribe-Post header indicates one-click support\n * @returns The best unsubscribe option, or null if none available\n */\nexport function getBestUnsubscribeOption(\n  options: UnsubscribeOption[],","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/Foundry376/Mailspring/blob/648c685d602ece6bb00c22534b8734de6ac644b3/app/internal_packages/list-unsubscribe/lib/unsubscribe-service.ts#L139-L175","documentation":"Validation guard in performWebUnsubscribe: the URL passed for one-click/browser unsubscribe failed the /^https?/ check, so opening it in the user's default browser is refused. Protects against arbitrary schemes (e.g. 'ftp:', 'javascript:') smuggled in via a List-Unsubscribe header.","triggerScenarios":"Thrown at app/internal_packages/list-unsubscribe/lib/unsubscribe-service.ts:157 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Parse the URL and require protocol http: or https: explicitly rather than a prefix regex","Show a warning to the user when the unsubscribe link in the header is unusable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"648c685d602ece6bb00c22534b8734de6ac644b3","analyzedAt":"2026-09-03T02:00:24.311Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T07:17:11.731Z"}