fix(template-helper): restrict escapeButPreserveUris to http/https schemes

escapeButPreserveUris() matched any scheme via [A-z]+?://, which also
turns javascript://, vbscript:// and data:// URIs into clickable links
on the generated error page, allowing script execution on click (XSS).
The [A-z] class was also invalid, spanning extra ASCII punctuation.

Restrict the scheme to http/https, the only two schemes that make
sense to linkify on an error page, leaving other schemes as plain
escaped text.

tests/Whoops/Util/TemplateHelperTest.php

@@ -63,6 +63,44 @@ class TemplateHelperTest extends TestCase
         );
     }
 
+    /**
+     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
+     */
+    public function testEscapeButPreserveUrisRejectsDangerousSchemes()
+    {
+        $dangerous = [
+            'javascript://x.co/?%0Aalert(1)',
+            'vbscript://x.co/?%0Amsgbox(1)',
+            'data://text/html,<script>alert(1)</script>',
+        ];
+
+        foreach ($dangerous as $payload) {
+            $output = $this->helper->escapeButPreserveUris($payload);
+
+            $this->assertStringNotContainsString(
+                '<a href=',
+                $output,
+                "Payload '$payload' must not be turned into a clickable link"
+            );
+        }
+    }
+
+    /**
+     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
+     */
+    public function testEscapeButPreserveUrisAllowsHttpAndHttpsSchemes()
+    {
+        $this->assertEquals(
+            "<a href=\"http://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">http://google.com</a>",
+            $this->helper->escapeButPreserveUris('http://google.com')
+        );
+
+        $this->assertEquals(
+            "<a href=\"https://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">https://google.com</a>",
+            $this->helper->escapeButPreserveUris('https://google.com')
+        );
+    }
+
     /**
      * @covers Whoops\Util\TemplateHelper::breakOnDelimiter
      */