Problem/Motivation
SmsLinkItem is missing all link validation constraints. PHP attributes don't inherit from parent to child class, so SmsLinkItem's #[FieldType] attribute (not re-specifying constraints) silently dropped LinkType/LinkAccess/LinkExternalProtocols/LinkNotExistingInternal — meaning sms_link fields accepted any URI unvalidated, including javascript:.
Proposed resolution
Explicitly re-declare the same constraints core's LinkItem uses.
Comments
Comment #3
ipwa commented