merge

packages/url_launcher/url_launcher_web/lib/url_launcher_web.dart

@@ -69,11 +69,22 @@ class UrlLauncherPlugin extends UrlLauncherPlatform {
   /// Returns the newly created window.
   @visibleForTesting
   html.Window? openNewWindow(String url, {String? webOnlyWindowName}) {
-    // We need to open mailto, tel and sms urls on the _top window context on safari browsers.
-    // See https://github.com/flutter/flutter/issues/51461 for reference.
+    final String? scheme = _getUrlScheme(url);
+    // Actively disallow opening some schemes, like javascript.
+    // See https://github.com/flutter/flutter/issues/136657
+    if (_isDisallowedScheme(scheme)) {
+      if (kDebugMode) {
+        print('Disallowed URL with scheme: $scheme');
+      }
+      return null;
+    }
+    // Some schemes need to be opened on the _top window context on Safari.
+    // See https://github.com/flutter/flutter/issues/51461
     final String target = webOnlyWindowName ??
-        ((_isSafari && _isSafariTargetTopScheme(url)) ? '_top' : '');
-    return _window.open(url, target);
+        ((_isSafari && _isSafariTargetTopScheme(scheme)) ? '_top' : '');
+
+    // ignore: unsafe_html
+    return _window.open(url, target, 'noopener,noreferrer');
   }
 
   @override

packages/url_launcher/url_launcher_web/pubspec.yaml

@@ -21,7 +21,7 @@ dependencies:
     sdk: flutter
   flutter_web_plugins:
     sdk: flutter
-  url_launcher_platform_interface: ^2.0.3
+  url_launcher_platform_interface: ^2.2.0
   web: ^0.3.0
 
 dev_dependencies: