Button markup

assets/dev/js/editor/utils/helpers.js

@@ -704,4 +704,12 @@ module.exports = {
 	sanitize( value, options ) {
 		return DOMPurify.sanitize( value, options );
 	},
+
+	sanitizeUrl( url ) {
+		const IS_ALLOWED_URI = /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i,
+			sanitizedUrl = DOMPurify.sanitize( url ),
+			isUrlAllowed = IS_ALLOWED_URI.test( sanitizedUrl );
+
+		return isUrlAllowed ? sanitizedUrl : '';
+	},
 };

includes/widgets/traits/button-trait.php

@@ -577,7 +577,7 @@ protected function content_template() {
 		view.addRenderAttribute( 'button', 'class', 'elementor-button' );
 
 		if ( '' !== settings.link.url ) {
-			view.addRenderAttribute( 'button', 'href', settings.link.url );
+			view.addRenderAttribute( 'button', 'href', elementor.helpers.sanitizeUrl( settings.link.url ) );
 			view.addRenderAttribute( 'button', 'class', 'elementor-button-link' );
 		} else {
 			view.addRenderAttribute( 'button', 'role', 'button' );