From 63bf3921b007a92b4f80c0006612fa261f04541a Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 29 Aug 2026 18:07:15 +0200
Subject: [PATCH] fix: only open safe URL schemes from contact cards

---
 src/screens/ContactDetailScreen.tsx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/screens/ContactDetailScreen.tsx b/src/screens/ContactDetailScreen.tsx
index 7e0e1e7a..c0f8fa33 100644
--- a/src/screens/ContactDetailScreen.tsx
+++ b/src/screens/ContactDetailScreen.tsx
@@ -15,6 +15,7 @@ import {
   Clock, KeyRound, FolderInput, Plus,
 } from 'lucide-react-native';
 import type { RootStackParamList } from '../navigation/types';
+import { openExternalUrl } from '../lib/open-url';
 import type { ContactCard } from '../api/types';
 import { useContactsStore } from '../stores/contacts-store';
 import {
@@ -177,7 +178,11 @@ export default function ContactDetailScreen() {
     Linking.openURL(`https://maps.google.com/?q=${encoded}`).catch(() => Alert.alert('Cannot open maps'));
   };
   const openUrl = (uri: string) => {
-    Linking.openURL(uri).catch(() => Alert.alert('Cannot open link'));
+    // Contact data is server-supplied: only hand http(s)/mailto/tel/sms/geo
+    // schemes to the OS, never intent:// / file:// / third-party deep links.
+    void openExternalUrl(uri).then((opened) => {
+      if (!opened) Alert.alert('Cannot open link');
+    });
   };
   const shareValue = (value: string) => {
     Share.share({ message: value }).catch(() => {});