From 59618371e9c2de7abeb866d14a100b976f0ba157 Mon Sep 17 00:00:00 2001
From: Simon Willison <swillison@gmail.com>
Date: Tue, 8 Sep 2026 20:56:33 -0700
Subject: [PATCH] Validate URL before rendering column links

---
 datasette/default_column_types.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/datasette/default_column_types.py b/datasette/default_column_types.py
index f90a733e..f5811aef 100644
--- a/datasette/default_column_types.py
+++ b/datasette/default_column_types.py
@@ -5,6 +5,7 @@ import markupsafe
 
 from datasette import hookimpl
 from datasette.column_types import ColumnType, SQLiteType
+from datasette.utils import is_url
 
 
 class UrlColumnType(ColumnType):
@@ -15,7 +16,10 @@ class UrlColumnType(ColumnType):
     async def render_cell(self, value, column, table, database, datasette, request):
         if not value or not isinstance(value, str):
             return None
-        escaped = markupsafe.escape(value.strip())
+        stripped = value.strip()
+        if not is_url(stripped):
+            return None
+        escaped = markupsafe.escape(stripped)
         return markupsafe.Markup(f'<a href="{escaped}">{escaped}</a>')
 
     async def validate(self, value, datasette):