[mzner]

backport validate .psec URL before opening

Description

Related Issue

• Fixes <issue_link>

Motivation and Context

How Has This Been Tested?

• test environment:
• test case 1:
• test case 2:
• ...

Screenshots (if appropriate):

Open tasks:

• ...

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[DeepDiver1975]

Faithful backport of #13924 (merged to master) onto stable-12.4 — keep both. Not a duplicate/mis-base: #13924 is the canonical fix, #13925 is its release-branch backport. Diff is byte-identical (150/12, same code + same changelog fragment).

Security logic checks out:

• Scheme allowlist (https:/http:) blocks javascript:/data:/blob: from a tampered .psec.
• Origin pinned to configStore.serverUrl, validated at both open and create time.
• iframe sandbox is sound defense-in-depth. No bypass apparent.

Changelog: present and valid; references PR #13924 — correct canonical ref for a backport.

Tests: cover scheme-bypass vectors + cross-origin on both open and create paths. Adequate.

CI: build still pending; everything else green. No concerns from review.

🤖 Generated with Claude Code