Return nil unless santitised string matches original.

apps/block_scout_web/lib/block_scout_web/views/tokens/instance/overview_view.ex

@@ -102,7 +102,14 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewView do
 
   def external_url(nil), do: nil
 
-  def external_url("http" <> _rest = external_url), do: external_url
+  def external_url("http" <> _rest = external_url) do
+    sanitised = external_url |> html_escape() |> safe_to_string()
+    if sanitised != external_url do
+      nil
+    else
+      external_url
+    end
+  end
 
   def external_url(string) when is_binary(string), do: external_url(nil)
 

apps/block_scout_web/test/block_scout_web/views/tokens/instance/overview_view_test.exs

@@ -139,16 +139,9 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewViewTest do
     end
 
     test "does not return html escape" do
-      json = """
-        {
-          "name": "CELO XSS",
-          "image": "https://0-a.nl/nft/nft.jpg",
-          "description": "CELO XSS",
-          "external_url": "https\" id=x tabindex=1 onfocusin=eval(atob('KGZ1bmN0aW9uKCl7d2luZG93LmV0aG'))"
-        }
-      """
-
-      data = Jason.decode!(json)
+      data = %{
+        "external_url" => "https\" id=x tabindex=1 onfocusin=eval(atob('KGZ1bmN0aW9uKCl7d2luZG93LmV0aG'))"
+      }
 
       result = OverviewView.external_url(%{metadata: data})
 
@@ -170,6 +163,7 @@ defmodule BlockScoutWeb.Tokens.Instance.OverviewViewTest do
       result = OverviewView.external_url(%{metadata: data})
 
       assert String.starts_with?(result, "http"), "Valid url should be returned"
+      assert result == "https://happyland.nft"
     end
   end
 end