🐛 fix(offscreen): extend URL scheme check to block data: and vbscript: hrefs

[Copilot]

CodeQL alert #5: extractLinks in offscreen.js only rejected javascript: hrefs, leaving data: and vbscript: — equally capable of encoding executable content — unfiltered during crawl link extraction.

Change

• js/offscreen.js — add data: and vbscript: to the href scheme rejection guard alongside the existing javascript: and mailto: checks:

if (
  href.startsWith("mailto:") ||
  href.startsWith("javascript:") ||
  href.startsWith("data:") ||      // added
  href.startsWith("vbscript:") ||  // added
  href.startsWith("#")
) {
  return;
}

[Copilot]

Pull request overview

This PR updates the offscreen crawl HTML parser to reject additional unsafe URL schemes during link extraction, addressing CodeQL alert #5 by preventing data: and vbscript: links from being returned by extractLinks().

Changes:

• Extend extractLinks()’s href scheme guard to also reject data: and vbscript: URLs (in addition to existing mailto:, javascript:, and #).
• Tighten crawl link extraction behavior to avoid propagating potentially executable-content URLs into the crawl pipeline.