Improved link validation and sanatization, in order to mitigate CVE-2025-56200 from validator.js NPM package.

src/utils/linkUtils.js

@@ -16,6 +16,7 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.*/
 
 //NPM Imports
 const validator = require('validator');//No express here, so regular validator it is!
+const {sanitizeUrl} = require("@braintree/sanitize-url");
 
 //Create link cache
 /**
@@ -25,10 +26,12 @@ module.exports.cache = new Map();
 
 /**
  * Validates links and returns a marked link object that can be returned to the client to format/embed accordingly
- * @param {String} link - URL to Validate
+ * @param {String} dirtyLink - URL to Validate
  * @returns {Object} Marked link object
  */
-module.exports.markLink = async function(link){
+module.exports.markLink = async function(dirtyLink){
+    const link = sanitizeUrl(dirtyLink);
+
     //Check link cache for the requested link
     const cachedLink = module.exports.cache.get(link);
 
@@ -44,7 +47,7 @@ module.exports.markLink = async function(link){
     var type = "malformedLink"    
 
     //Make sure we have an actual, factual URL
-    if(validator.isURL(link)){
+    if(validator.isURL(link,{require_valid_protocol: true, protocols: ['http', 'https']})){
         //The URL is valid, so this is at least a dead link
         type = 'deadLink';