fix(amazonq): For security reasons, disabled auto linkify for pure text links (#5306)

dogusata · web-flow · commit f9547e859061 · 2025-01-28T14:43:34.000-08:00
Problem

    Links incoming from Q responses can redirect to a vulnerable site depending on the used context from the files.

Solution

    Linkify strategy is updated to only accept links with [TEXT](URL) format. (through MynahUI version 4.21.6)
diff --git a/.changes/next-release/bugfix-5ad182a1-df86-4b08-b7ae-d409fdf2d690.json b/.changes/next-release/bugfix-5ad182a1-df86-4b08-b7ae-d409fdf2d690.json
@@ -0,0 +1,4 @@
+{
+  "type" : "bugfix",
+  "description" : "fix(amazonq): For security reasons, disabled auto linkify for link texts coming in markdown other than [TEXT](URL) format"
+}
diff --git a/plugins/amazonq/mynah-ui/package-lock.json b/plugins/amazonq/mynah-ui/package-lock.json
diff --git a/plugins/amazonq/mynah-ui/package.json b/plugins/amazonq/mynah-ui/package.json
@@ -12,7 +12,7 @@
         "lintfix": "eslint -c .eslintrc.js --fix --ext .ts ."
     },
     "dependencies": {
-        "@aws/mynah-ui-chat": "npm:@aws/mynah-ui@4.21.5",
+        "@aws/mynah-ui-chat": "npm:@aws/mynah-ui@4.21.6",
         "@types/node": "^14.18.5",
         "fs-extra": "^10.0.1",
         "sanitize-html": "^2.12.1",

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +{
 +  "type" : "bugfix",
 +  "description" : "fix(amazonq): For security reasons, disabled auto linkify for link texts coming in markdown other than [TEXT](URL) format"
 +}