fix: sanitize public provenance links

apps/web/tests/unit/presentation.test.ts

@@ -8,6 +8,7 @@ import { waterbodyVisual } from "../../src/lib/waterbody-visuals.ts";
 import { pageHref, pageWindow } from "../../src/lib/pagination.ts";
 import { adminEndsSession, adminErrorMessage } from "../../src/lib/admin-errors.ts";
 import { findMediaByLabel, mediaRoleLabel } from "../../src/lib/media.ts";
+import { safeHttpUrl } from "../../src/lib/urls.ts";
 
 test("activity levels share one complete 0-100 scale", () => {
   assert.deepEqual(
@@ -46,6 +47,14 @@ test("coordinate precision keeps all four public states explicit", () => {
   assert.equal(coordinatePrecisionLabel("future"), "не указаны");
 });
 
+test("provenance links allow only credential-free HTTP(S) URLs", () => {
+  assert.equal(safeHttpUrl("https://rf4db.com/ru/maps"), "https://rf4db.com/ru/maps");
+  assert.equal(safeHttpUrl("http://localhost:8000/source"), "http://localhost:8000/source");
+  assert.equal(safeHttpUrl("javascript:alert(1)"), null);
+  assert.equal(safeHttpUrl("https://user:secret@rf4db.com/source"), null);
+  assert.equal(safeHttpUrl("not a url"), null);
+});
+
 test("source status makes a blocked provider explicit", () => {
   assert.equal(sourceStatusLabel("temporarily_limited"), "Источник временно ограничен");
   assert.equal(sourceStatusLabel("healthy"), "Актуален");