From ea11646d8df7f612c79cfa4dddc588d9cdf7f48f Mon Sep 17 00:00:00 2001
From: Charles de Dreuille <charles.dedreuille@gmail.com>
Date: Tue, 21 Apr 2026 09:34:34 +0100
Subject: [PATCH] fix(ui): address second round of PR review comments

- Replace hardcoded gap: 20px with var(--bui-space-5) in metadata row
- Trim leading whitespace from href before unsafe-scheme check to prevent bypass

Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
---
 packages/ui/src/components/Header/Header.module.css | 2 +-
 packages/ui/src/components/Header/Header.tsx        | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/ui/src/components/Header/Header.module.css b/packages/ui/src/components/Header/Header.module.css
index ccceaf6f58..e6ea55e363 100644
--- a/packages/ui/src/components/Header/Header.module.css
+++ b/packages/ui/src/components/Header/Header.module.css
@@ -68,7 +68,7 @@
     display: flex;
     flex-direction: row;
     align-items: center;
-    gap: 20px;
+    gap: var(--bui-space-5);
     flex-wrap: wrap;
   }
 
diff --git a/packages/ui/src/components/Header/Header.tsx b/packages/ui/src/components/Header/Header.tsx
index f70423fdd6..90e107c51c 100644
--- a/packages/ui/src/components/Header/Header.tsx
+++ b/packages/ui/src/components/Header/Header.tsx
@@ -49,7 +49,9 @@ function renderInlineMarkdown(text: string): React.ReactNode[] {
     if (match.index > last) {
       parts.push(text.slice(last, match.index));
     }
-    const href = match[2];
+    // Trim leading whitespace/control chars before scheme check to prevent
+    // bypass via inputs like " javascript:alert(1)".
+    const href = match[2].trimStart();
     const label = match[1];
     if (UNSAFE_HREF_RE.test(href)) {
       parts.push(label);