fix: prevent XSS via javascript: URIs in recipe actions (#6885)

mealie/schema/household/group_recipe_action.py

@@ -1,7 +1,7 @@
 from enum import Enum
 from typing import Any
 
-from pydantic import UUID4, ConfigDict
+from pydantic import UUID4, ConfigDict, field_validator
 
 from mealie.schema._mealie import MealieModel
 from mealie.schema.response.pagination import PaginationBase
@@ -22,6 +22,14 @@ class CreateGroupRecipeAction(MealieModel):
 
     model_config = ConfigDict(use_enum_values=True)
 
+    @field_validator("url")
+    def validate_url_scheme(url: str) -> str:
+        """Validate that the URL uses a safe scheme to prevent XSS via javascript: URIs."""
+        url_lower = url.lower().strip()
+        if not (url_lower.startswith("http://") or url_lower.startswith("https://")):
+            raise ValueError("URL must use http or https scheme")
+        return url
+
 
 class SaveGroupRecipeAction(CreateGroupRecipeAction):
     group_id: UUID4