fix(template-helper): restrict escapeButPreserveUris to http/https schemes

escapeButPreserveUris() matched any scheme via [A-z]+?://, which also
turns javascript://, vbscript:// and data:// URIs into clickable links
on the generated error page, allowing script execution on click (XSS).
The [A-z] class was also invalid, spanning extra ASCII punctuation.

Restrict the scheme to http/https, the only two schemes that make
sense to linkify on an error page, leaving other schemes as plain
escaped text.

src/Whoops/Util/TemplateHelper.php

@@ -80,6 +80,9 @@ class TemplateHelper
      * Escapes a string for output in an HTML document, but preserves
      * URIs within it, and converts them to clickable anchor elements.
      *
+     * Only http and https URIs are linkified; other schemes are left as
+     * plain escaped text so that a link cannot execute script when clicked.
+     *
      * @param  string $raw
      * @return string
      */
@@ -87,7 +90,7 @@ class TemplateHelper
     {
         $escaped = $this->escape($raw);
         return preg_replace(
-            "@([A-z]+?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@",
+            "@(https?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@i",
             "<a href=\"$1\" target=\"_blank\" rel=\"noreferrer noopener\">$1</a>",
             $escaped
         );

tests/Whoops/Util/TemplateHelperTest.php

@@ -63,6 +63,44 @@ class TemplateHelperTest extends TestCase
         );
     }
 
+    /**
+     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
+     */
+    public function testEscapeButPreserveUrisRejectsDangerousSchemes()
+    {
+        $dangerous = [
+            'javascript://x.co/?%0Aalert(1)',
+            'vbscript://x.co/?%0Amsgbox(1)',
+            'data://text/html,<script>alert(1)</script>',
+        ];
+
+        foreach ($dangerous as $payload) {
+            $output = $this->helper->escapeButPreserveUris($payload);
+
+            $this->assertStringNotContainsString(
+                '<a href=',
+                $output,
+                "Payload '$payload' must not be turned into a clickable link"
+            );
+        }
+    }
+
+    /**
+     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
+     */
+    public function testEscapeButPreserveUrisAllowsHttpAndHttpsSchemes()
+    {
+        $this->assertEquals(
+            "<a href=\"http://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">http://google.com</a>",
+            $this->helper->escapeButPreserveUris('http://google.com')
+        );
+
+        $this->assertEquals(
+            "<a href=\"https://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">https://google.com</a>",
+            $this->helper->escapeButPreserveUris('https://google.com')
+        );
+    }
+
     /**
      * @covers Whoops\Util\TemplateHelper::breakOnDelimiter
      */