Guard against invalid URLs

src/components/link.jsx

@@ -22,6 +22,7 @@ const Link = forwardRef((props, ref) => {
 
   // Handle encodeURIComponent of searchParams values
   if (!!hash && hash !== '/' && hash.includes('?')) {
+    try {
       const parsedHash = new URL(hash, location.origin); // Fake base URL
       if (parsedHash.searchParams.size) {
         const searchParamsStr = Array.from(parsedHash.searchParams.entries())
@@ -29,6 +30,7 @@ const Link = forwardRef((props, ref) => {
           .join('&');
         hash = parsedHash.pathname + '?' + searchParamsStr;
       }
+    } catch (e) {}
   }
 
   const isActive = hash === to || decodeURIComponent(hash) === to;

src/components/status.jsx

@@ -2269,7 +2269,12 @@ function _unfurlMastodonLink(instance, url) {
     theURL = `https://${finalURL}`;
   }
 
-  const urlObj = new URL(theURL);
+  let urlObj;
+  try {
+    urlObj = new URL(theURL);
+  } catch (e) {
+    return;
+  }
   const domain = urlObj.hostname;
   const path = urlObj.pathname;
   // Regex /:username/:id, where username = @username or @username@domain, id = number

src/utils/isMastodonLinkMaybe.jsx

@@ -1,4 +1,5 @@
 export default function isMastodonLinkMaybe(url) {
+  try {
     const { pathname, hash } = new URL(url);
     return (
       /^\/.*\/\d+$/i.test(pathname) ||
@@ -8,4 +9,7 @@ export default function isMastodonLinkMaybe(url) {
       /^\/(notice|objects)\/[a-z0-9-]+$/i.test(pathname) || // Pleroma
       /#\/[^\/]+\.[^\/]+\/s\/.+/i.test(hash) // Phanpy 🫣
     );
+  } catch (e) {
+    return false;
+  }
 }