forbid opening local html files in iframes

lib/Properties.hs

@@ -225,7 +225,9 @@ checkLayer = do
 
 checkObjectProperty :: Object -> Property -> LintWriter Layer
 checkObjectProperty obj p@(Property name _) = case name of
-  "url" -> pure ()
+  "url" -> unwrapURI (Proxy @"website") p
+    (dependsOn . Link)
+    (const $ forbid "using \"url\" to open local html files is disallowed.")
   "allowApi" -> forbidProperty name
   "getBadge" -> do
     when (1 /= length (getProperties obj))
@@ -329,7 +331,7 @@ checkTileLayerProperty p@(Property name _value) = case name of
       suggestProperty $ Property "openWebsiteTrigger" (StrProp "onaction")
       unwrapURI (Proxy @"website") p
         (dependsOn . Link)
-        (dependsOn . Local)
+        (const $ forbid "using openWebsite to access local html files is disallowed.")
     "openWebsiteTrigger" -> do
       isString p
       requireProperty "openWebsite"