TYPO3 Core

Do we need to do anything here at all?

I mean you can perfectly write this in your template:

<a href="{data.foo}">Bar</a>

There is no way on our side to prevent it.

In general the usefulness of <f:link.external> is close to 0.

So I'd rather deprecate the whole view helper instead of trying to fix it somehow.

So I'd rather deprecate the whole view helper instead of trying to fix it somehow.

Full ack!

I still kinda think that this does not need a fix.

ContentObjectRenderer is different because typolink
is very commonly used on user input from editors, where
the scope here rather is integrators/ admins.

If admins use this vh insecurely in a template it is in them
to fix it.

Fixing this here would be breaking for legit usages
if this vh (still wondering the usefulness of it in general
but why would a fixed string url with data: or javascript:
should be denied, while having it in a <a> tag not)

I would rather make this public and let "the community" decide whether
we should help admins not shoot in their foot

If we handle it in public, I'm actually for deprecating this viewhelper or actually removing it in v9 completely.

I think the assumption is correct, that people rather would have used the TypolinkViewHelper instead of the ExternalViewHelper if it's user input in general. Thus, I'd opt for making this issue public then and let the community comment on it.

I guilty neglected this one for too long - I am of the opinion to remove <f:link.external> too, as I don't remember much benefits respect to a plain <a href="">

Do we need proper deprecation here?