fix: address widget review feedback

packages/widgets/src/iframe/component.spec.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { getAllowedPermissions, getSandboxFlags, isSupportedProtocol } from "./component";
+import { getAllowedPermissions, getFrameTitle, getSandboxFlags, isSupportedProtocol } from "./component";
 
 const permissions = {
   allowFullScreen: true,
@@ -23,4 +23,12 @@ describe("iframe policy", () => {
     expect(isSupportedProtocol("javascript:alert(1)")).toBe(false);
     expect(isSupportedProtocol("not a url")).toBe(false);
   });
+
+  it("creates a display title without credentials, paths, or query parameters", () => {
+    expect(getFrameTitle("https://user:secret@example.com/private?token=sensitive")).toBe("example.com");
+  });
+
+  it("keeps a non-default port in the display title", () => {
+    expect(getFrameTitle("http://user:secret@example.com:8080/private?token=sensitive")).toBe("example.com:8080");
+  });
 });

packages/widgets/src/iframe/component.tsx

@@ -28,7 +28,7 @@ export default function IFrameWidget({ options, isEditMode, displayMode }: Widge
             {getFrameTitle(embedUrl)}
           </Text>
           <Anchor href={embedUrl} target="_blank" rel="noreferrer" size="xs">
-            {embedUrl}
+            {t("widget.app.option.openInNewTab.label")}
           </Anchor>
         </Group>
       )}
@@ -138,9 +138,9 @@ const permissionMapping: Partial<
   allowPayment: "payment",
 };
 
-const getFrameTitle = (url: string) => {
+export const getFrameTitle = (url: string) => {
   try {
-    return new URL(url).hostname;
+    return new URL(url).host;
   } catch {
     return "iframe";
   }