From 1aa77e6698f70d1f7e0659653aa5c5c0c354ac54 Mon Sep 17 00:00:00 2001
From: CaIon <i@caion.me>
Date: Thu, 18 Jun 2026 14:56:44 +0800
Subject: [PATCH] fix(ui): enforce HTTPS for backend-provided image URLs and
 improve URL validation

---
 web/default/src/features/wallet/lib/ui.tsx | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/web/default/src/features/wallet/lib/ui.tsx b/web/default/src/features/wallet/lib/ui.tsx
index 1187f93d..41a75eb6 100644
--- a/web/default/src/features/wallet/lib/ui.tsx
+++ b/web/default/src/features/wallet/lib/ui.tsx
@@ -27,26 +27,24 @@ import { PAYMENT_TYPES, PAYMENT_ICON_COLORS } from '../constants'
 // UI Helper Functions
 // ============================================================================
 
-const HAS_LOCATION =
-  typeof globalThis !== 'undefined' && 'location' in globalThis
-
 /**
- * Resolves a backend-provided image URL to http(s) only. Rejects javascript:,
- * data:, blob:, file:, and URLs with userinfo, which are unsafe in <img src/>.
+ * Resolves a backend-provided image URL to https only. Rejects http:,
+ * data:, blob:, file:, relative paths, and URLs with userinfo, which are unsafe
+ * or ambiguous in <img src/>.
  */
 function normalizeHttpIconUrl(raw: string | undefined | null): string | null {
   if (!raw) return null
   const s = raw.trim()
   if (!s) return null
+  if (!/^https:\/\//i.test(s)) return null
+
   let url: URL
   try {
-    url = HAS_LOCATION
-      ? new URL(s, (globalThis as { location: Location }).location.href)
-      : new URL(s)
+    url = new URL(s)
   } catch {
     return null
   }
-  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+  if (url.protocol !== 'https:') {
     return null
   }
   if (url.username || url.password) {