Repository: migration-planner-ui-app Priority: High Location: src/ui/environment/views/AgentStatusView.tsx:50 (also CreateFromOva.tsx:196, Environment.tsx:131)

Description: Discovery agents self-report credentialUrl when registering. The UI renders this string as react-router-dom <Link to=> prop and plain <a href> with no scheme validation. react-router-dom 6.30.3 passes absolute-scheme URLs to DOM <a href>, and React 18.3.1 only warns in dev mode about javascript: - production builds render verbatim. Users are instructed to click the link to reach the discovery VM.

Security Impact:

Attacker registers agent with credentialUrl: "javascript:..."

Stored payload executes in http://console.redhat.com origin when any org user clicks link

Yields victim's RH SSO session, enabling cross-tenant data access and API actions as victim

Persistent compromise within organization

Fix Suggestion: Introduce safeExternalUrl() helper that parses URL and returns only if protocol is http: or https:. Gate all three render sites so non-http(s) credentialUrl doesn't render as link. See patches/f101.patch.