Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

web/skins/classic/js/skin.js

@@ -101,8 +101,14 @@ window.addEventListener("DOMContentLoaded", function onSkinDCL() {
       evt.preventDefault();
       // Only navigate to safe schemes; block javascript:/data:/vbscript: URLs
       // in href/data-url so a crafted attribute cannot run script on click.
-      if (url && !/^\s*(javascript|data|vbscript):/i.test(url)) {
-        window.location.assign(url);
+      try {
+        const parsed = new URL(String(url), document.baseURI);
+        const proto = parsed.protocol.toLowerCase();
+        if (proto === 'http:' || proto === 'https:') {
+          window.location.assign(parsed.href);
+        }
+      } catch (e) {
+        // Ignore invalid URLs
       }
     });
   });