fix(window): reject non-document navigation schemes

src/main/window/privileged-window-navigation.test.ts

@@ -55,13 +55,16 @@ describe('privileged window navigation policy', () => {
     expect(openExternal).toHaveBeenCalledWith('https://example.com/')
   })
 
-  it('lets the dev renderer origin navigate but not a foreign origin', () => {
+  it('lets the dev renderer origin navigate but blocks foreign documents', () => {
     const fixture = createFixture('http://localhost:5173/')
 
     expect(
       fixture.willNavigate('http://localhost:5173/index.html').preventDefault
     ).not.toHaveBeenCalled()
     expect(fixture.willNavigate('https://example.com/').preventDefault).toHaveBeenCalled()
+    expect(
+      fixture.willNavigate('blob:http://localhost:5173/attacker-document').preventDefault
+    ).toHaveBeenCalled()
   })
 
   // Why: the packaged file: path is the whole privilege boundary, so a foreign host or a

src/main/window/renderer-document-navigation.ts

@@ -19,6 +19,7 @@ export function isRendererDocumentNavigation(currentUrl: string, nextUrl: string
     }
     return (
       (current.protocol === 'http:' || current.protocol === 'https:') &&
+      (next.protocol === 'http:' || next.protocol === 'https:') &&
       next.origin === current.origin
     )
   } catch {