From ed38402e346f24d1026ea0d75468f26cd1768411 Mon Sep 17 00:00:00 2001
From: Alex Xu <alexkurosakimh3@gmail.com>
Date: Fri, 6 Nov 2026 12:25:54 -0800
Subject: [PATCH] messages have domain allowlist (#1502)

---
 kindlecomicconverter/KCC_gui.py | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/kindlecomicconverter/KCC_gui.py b/kindlecomicconverter/KCC_gui.py
index a7b1ccaa..02d40b6a 100644
--- a/kindlecomicconverter/KCC_gui.py
+++ b/kindlecomicconverter/KCC_gui.py
@@ -199,6 +199,16 @@ class VersionThread(QThread):
                                        headers={
                                            'Accept': 'application/vnd.github.raw+json',
                                            'X-GitHub-Api-Version': '2022-11-28'}).json()
+            link_allowlist = (
+                'https://humblebundleinc.sjv.io/',
+                'https://www.humblebundle.com/',
+                'https://www.awin1.com/',
+                'https://www.fanatical.com/',
+                'https://kodansha.us/',
+                'https://youtu.be/',
+                'https://www.youtube.com/',
+                'https://www.linkedin.com/',
+            )
             for category, payloads in announcements.items():
                 for payload in payloads:
                     if not isinstance(payload, dict):
@@ -218,8 +228,12 @@ class VersionThread(QThread):
                     if category == 'kofi':
                         icon = 'kofi'
                     message = f"{payload.get('name')}"
-                    if payload.get('link'):
-                        message = '<a href="{}"><b>{}</b></a>'.format(payload.get('link'), payload.get('name'))
+                    link = payload.get('link')
+                    if link:
+                        for allowed_link in link_allowlist:
+                            if link.startswith(allowed_link):
+                                message = '<a href="{}"><b>{}</b></a>'.format(payload.get('link'), payload.get('name'))
+                                break
                     if payload.get('showDeadline'):
                         message += f': {time_left}'
                     if category == 'humbleBundles':