GitHub

`openUrl` permits `javascript:` URI execution via agent-supplied button actions

0.9.0, 0.9.1, 0.9.2, 0.10.0, 0.10.1 ...
GitHub

[Javascript][Rendering/Templating] Invalid Action.OpenUrl url parameter can break card ...

JavaScript Author or host Teams Version of SDK 1.2.3 Details Previously when an invalid URL was passed to the Action.OpenUrl action (e.g. because invalid input was passed by a user from previous ...