From b68209e14b083116967814260f5cab252bb373f6 Mon Sep 17 00:00:00 2001
From: MDLeom <2809763-curben@users.noreply.gitlab.com>
Date: Thu, 13 Nov 2025 08:27:10 +0000
Subject: [PATCH] feat(clean_url): esvalabs

---
 src/clean_url.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/clean_url.js b/src/clean_url.js
index 1ae0b510..a2c79b3e 100644
--- a/src/clean_url.js
+++ b/src/clean_url.js
@@ -19,7 +19,8 @@ const safeLinks = [
   'safelinks\\.protection\\.outlook\\.com',
   '\\.protection\\.sophos\\.com',
   'linkprotect\\.cudasvc\\.com',
-  'ctp\\.trendmicro\\.com'
+  'ctp\\.trendmicro\\.com',
+  'urlsand\\.esvalabs\\.com'
 ]
 
 const deSafelink = (urlStr) => {
@@ -87,6 +88,11 @@ const deSafelink = (urlStr) => {
     url = new URL(url.searchParams.get('q'))
   }
 
+  // EsvaLabs
+  if (url.hostname === 'urlsand.esvalabs.com') {
+    url = new URL(url.searchParams.get('u'))
+  }
+
   // "Just have to go deep enough."
   if (url.hostname.match(new RegExp(safeLinks.join('|')))) {
     return deSafelink(url.href)