MD/HTML can be used to falsify link targets

[pacien]

Description

It's possible to use Markdown/HTML formatting to hide the real target of a link.
This could be used in phishing attacks.

Steps to reproduce

{
  "content": {
    "body": "[https://www.mq.edu.au/about/coronavirus-faqs/updates-from-the-vc](https://www.youtube.com/watch?v=dQw4w9WgXcQ)",
    "format": "org.matrix.custom.html",
    "formatted_body": "<a href=\"https://www.youtube.com/watch?v=dQw4w9WgXcQ\">https://www.mq.edu.au/about/coronavirus-faqs/updates-from-the-vc</a>",
    "msgtype": "m.text"
  }
}

is rendered as:

Mitigation

Other instant messaging apps and most email clients display a warning/confirmation pop-up when clicking on this kind of links, clearly displaying the actual target to the user and letting them choose whether to open it or not.

Version information

• Platform: web and desktop
• Version: 1.5.12

Riot on mobile might be affected too.

[t3chguy]

Duplicate of #7748