From 02bd1f01b6c1f6bf1aa7bb7cd38ac728c64d8b68 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Tue, 10 Feb 2026 19:15:29 -0400
Subject: [PATCH 01/16] =?UTF-8?q?FOUR-29250=20End=20Event=20=E2=80=93=20Ex?=
 =?UTF-8?q?ternal=20URL=20with=20Mustache/FEEL=20Support=20Description:=20?=
 =?UTF-8?q?feat(end=20event):=20support=20Mustache=20in=20external=20URL?=
 =?UTF-8?q?=20for=20element=20destination?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Resolve Mustache expressions in end event "External URL" when the token
  reaches the end event, using the same context as scripts/screens
  (APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
  with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
  URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
  also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
  and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
  helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
---
 src/components/inspectors/ElementDestination.vue | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/components/inspectors/ElementDestination.vue b/src/components/inspectors/ElementDestination.vue
index 5a907d1f1..f2d29e2cb 100644
--- a/src/components/inspectors/ElementDestination.vue
+++ b/src/components/inspectors/ElementDestination.vue
@@ -50,7 +50,7 @@
       :error="getValidationErrorForURL(externalURL)"
       data-cy="events-add-id"
       :placeholder="urlPlaceholder"
-      :helper="$t('Determine the URL where the request will end')"
+      :helper="$t('URL where the request will redirect. Supports Mustache: {{APP_URL}}, {{_request.id}}, {{_user.id}}, process variables.')"
       data-test="external-url"
     />
     <process-form-select
@@ -174,12 +174,22 @@ export default {
   },
   methods: {
     getValidationErrorForURL(url) {
+      if (!url || !url.trim()) {
+        return '';
+      }
       if (!this.isValidURL(url)) {
-        return this.$t('Must be a valid URL');
+        return this.$t('Must be a valid URL or Mustache expressions ({{APP_URL}}, {{_request.id}}, {{_user.id}}, process variables).');
       }
       return '';
     },
     isValidURL(string) {
+      if (!string || typeof string !== 'string') {
+        return true;
+      }
+      // Allow Mustache: same context as backend (APP_URL, _request, _user, process variables)
+      if (string.includes('{{')) {
+        return true;
+      }
       try {
         new URL(string);
         return true;

From a900ff2500caac81a82b2b841f9ea9732638ac5c Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Wed, 11 Feb 2026 09:58:46 -0400
Subject: [PATCH 02/16] FOUR-29250 Add InspectorConfigViewer: collapsible card
 in modeler inspector to display element configuration data (formData) as
 key-value pairs with keyboard-accessible toggle.

---
 .../inspectors/InspectorConfigViewer.vue      | 134 ++++++++++++++++++
 1 file changed, 134 insertions(+)
 create mode 100644 src/components/inspectors/InspectorConfigViewer.vue

diff --git a/src/components/inspectors/InspectorConfigViewer.vue b/src/components/inspectors/InspectorConfigViewer.vue
new file mode 100644
index 000000000..e965c1e9c
--- /dev/null
+++ b/src/components/inspectors/InspectorConfigViewer.vue
@@ -0,0 +1,134 @@
+<template>
+  <b-card
+    no-body
+    class="border-top mt-1 rounded-0 inspector-config-viewer__card"
+  >
+    <b-card-header
+      v-b-toggle.inspector-config-viewer-body
+      class="p-2 d-flex align-items-center inspector-config-viewer__header"
+      role="button"
+      tabindex="0"
+      @keydown="onHeaderKeydown"
+    >
+      <span class="inspector-config-viewer__title">{{ $t('Configuration data') }}</span>
+      <i class="ml-1 fas fa-chevron-down inspector-config-viewer__chevron" />
+    </b-card-header>
+    <b-collapse id="inspector-config-viewer-body" class="inspector-config-viewer__collapse">
+      <b-card-body class="p-2 inspector-config-viewer__body">
+        <div v-if="displayItems.length === 0" class="inspector-config-viewer__empty text-muted">
+          {{ $t('No data') }}
+        </div>
+        <dl v-else class="inspector-config-viewer__list mb-0">
+          <template v-for="(item, index) in displayItems">
+            <dt :key="`key-${index}`" class="inspector-config-viewer__key">{{ item.key }}</dt>
+            <dd :key="`val-${index}`" class="inspector-config-viewer__value">{{ item.value }}</dd>
+          </template>
+        </dl>
+      </b-card-body>
+    </b-collapse>
+  </b-card>
+</template>
+
+<script>
+export default {
+  name: 'InspectorConfigViewer',
+  props: {
+    node: {
+      type: Object,
+      default: null,
+    },
+    formData: {
+      type: Object,
+      default: () => ({}),
+    },
+  },
+  computed: {
+    displayItems() {
+      if (!this.formData || typeof this.formData !== 'object') {
+        return [];
+      }
+      const entries = Object.entries(this.formData).filter(([key]) => !key.startsWith('$'));
+      const meta = [];
+      if (this.node) {
+        if (this.node.type) meta.push({ key: '__type', value: this.node.type });
+        if (this.node.id) meta.push({ key: '__id', value: this.node.id });
+      }
+      const rows = entries.map(([key, value]) => ({
+        key,
+        value: this.formatValue(value),
+      }));
+      return [...meta, ...rows];
+    },
+  },
+  methods: {
+    onHeaderKeydown(ev) {
+      if (ev.key === 'Enter' || ev.key === ' ') {
+        ev.preventDefault();
+        this.$root.$emit('bv::toggle::collapse', 'inspector-config-viewer-body');
+      }
+    },
+    formatValue(value) {
+      if (value === null || value === undefined) return '';
+      if (typeof value === 'object') {
+        try {
+          return JSON.stringify(value);
+        } catch (_) {
+          return Object.prototype.toString.call(value);
+        }
+      }
+      return String(value);
+    },
+  },
+};
+</script>
+
+<style lang="scss" scoped>
+.inspector-config-viewer__card {
+  font-size: 0.75rem;
+  flex-shrink: 0;
+}
+
+.inspector-config-viewer__header {
+  cursor: pointer;
+  font-size: 0.8125rem;
+  min-height: auto;
+  line-height: 1.3;
+  background: #f8f9fa;
+}
+
+.inspector-config-viewer__title {
+  font-weight: 600;
+}
+
+.inspector-config-viewer__chevron {
+  font-size: 0.65rem;
+  transition: transform 0.2s;
+}
+
+.inspector-config-viewer__body {
+  max-height: 12rem;
+  overflow-y: auto;
+  font-size: 0.75rem;
+}
+
+.inspector-config-viewer__list {
+  display: grid;
+  grid-template-columns: minmax(6rem, auto) 1fr;
+  gap: 0.15rem 0.5rem;
+}
+
+.inspector-config-viewer__key {
+  margin: 0;
+  color: #6c757d;
+  word-break: break-word;
+}
+
+.inspector-config-viewer__value {
+  margin: 0;
+  word-break: break-all;
+}
+
+.inspector-config-viewer__empty {
+  font-size: 0.75rem;
+}
+</style>

From 1b5ac669d2c6af1b28e35b7660192acaf0aeb4be Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Wed, 11 Feb 2026 10:03:19 -0400
Subject: [PATCH 03/16] FOUR-29250 Remove InspectorConfigViewer and update
 ElementDestination.

---
 .../inspectors/ElementDestination.vue         |   5 +-
 .../inspectors/InspectorConfigViewer.vue      | 134 ------------------
 2 files changed, 4 insertions(+), 135 deletions(-)
 delete mode 100644 src/components/inspectors/InspectorConfigViewer.vue

diff --git a/src/components/inspectors/ElementDestination.vue b/src/components/inspectors/ElementDestination.vue
index f2d29e2cb..e5a51a37c 100644
--- a/src/components/inspectors/ElementDestination.vue
+++ b/src/components/inspectors/ElementDestination.vue
@@ -50,7 +50,7 @@
       :error="getValidationErrorForURL(externalURL)"
       data-cy="events-add-id"
       :placeholder="urlPlaceholder"
-      :helper="$t('URL where the request will redirect. Supports Mustache: {{APP_URL}}, {{_request.id}}, {{_user.id}}, process variables.')"
+      :helper="externalUrlHelperText"
       data-test="external-url"
     />
     <process-form-select
@@ -159,6 +159,9 @@ export default {
 
       return this.$t('Select where to send users after this task. Any Non-default destination will disable the "Display Next Assigned Task" function.');
     },
+    externalUrlHelperText() {
+      return this.$t('URL where the request will redirect. Supports Mustache:') + ' {{APP_URL}}, {{_request.id}}, {{_user.id}}, ' + this.$t('process variables.');
+    },
   },
   created() {
     this.loadDashboardsDebounced = debounce((filter) => {
diff --git a/src/components/inspectors/InspectorConfigViewer.vue b/src/components/inspectors/InspectorConfigViewer.vue
deleted file mode 100644
index e965c1e9c..000000000
--- a/src/components/inspectors/InspectorConfigViewer.vue
+++ /dev/null
@@ -1,134 +0,0 @@
-<template>
-  <b-card
-    no-body
-    class="border-top mt-1 rounded-0 inspector-config-viewer__card"
-  >
-    <b-card-header
-      v-b-toggle.inspector-config-viewer-body
-      class="p-2 d-flex align-items-center inspector-config-viewer__header"
-      role="button"
-      tabindex="0"
-      @keydown="onHeaderKeydown"
-    >
-      <span class="inspector-config-viewer__title">{{ $t('Configuration data') }}</span>
-      <i class="ml-1 fas fa-chevron-down inspector-config-viewer__chevron" />
-    </b-card-header>
-    <b-collapse id="inspector-config-viewer-body" class="inspector-config-viewer__collapse">
-      <b-card-body class="p-2 inspector-config-viewer__body">
-        <div v-if="displayItems.length === 0" class="inspector-config-viewer__empty text-muted">
-          {{ $t('No data') }}
-        </div>
-        <dl v-else class="inspector-config-viewer__list mb-0">
-          <template v-for="(item, index) in displayItems">
-            <dt :key="`key-${index}`" class="inspector-config-viewer__key">{{ item.key }}</dt>
-            <dd :key="`val-${index}`" class="inspector-config-viewer__value">{{ item.value }}</dd>
-          </template>
-        </dl>
-      </b-card-body>
-    </b-collapse>
-  </b-card>
-</template>
-
-<script>
-export default {
-  name: 'InspectorConfigViewer',
-  props: {
-    node: {
-      type: Object,
-      default: null,
-    },
-    formData: {
-      type: Object,
-      default: () => ({}),
-    },
-  },
-  computed: {
-    displayItems() {
-      if (!this.formData || typeof this.formData !== 'object') {
-        return [];
-      }
-      const entries = Object.entries(this.formData).filter(([key]) => !key.startsWith('$'));
-      const meta = [];
-      if (this.node) {
-        if (this.node.type) meta.push({ key: '__type', value: this.node.type });
-        if (this.node.id) meta.push({ key: '__id', value: this.node.id });
-      }
-      const rows = entries.map(([key, value]) => ({
-        key,
-        value: this.formatValue(value),
-      }));
-      return [...meta, ...rows];
-    },
-  },
-  methods: {
-    onHeaderKeydown(ev) {
-      if (ev.key === 'Enter' || ev.key === ' ') {
-        ev.preventDefault();
-        this.$root.$emit('bv::toggle::collapse', 'inspector-config-viewer-body');
-      }
-    },
-    formatValue(value) {
-      if (value === null || value === undefined) return '';
-      if (typeof value === 'object') {
-        try {
-          return JSON.stringify(value);
-        } catch (_) {
-          return Object.prototype.toString.call(value);
-        }
-      }
-      return String(value);
-    },
-  },
-};
-</script>
-
-<style lang="scss" scoped>
-.inspector-config-viewer__card {
-  font-size: 0.75rem;
-  flex-shrink: 0;
-}
-
-.inspector-config-viewer__header {
-  cursor: pointer;
-  font-size: 0.8125rem;
-  min-height: auto;
-  line-height: 1.3;
-  background: #f8f9fa;
-}
-
-.inspector-config-viewer__title {
-  font-weight: 600;
-}
-
-.inspector-config-viewer__chevron {
-  font-size: 0.65rem;
-  transition: transform 0.2s;
-}
-
-.inspector-config-viewer__body {
-  max-height: 12rem;
-  overflow-y: auto;
-  font-size: 0.75rem;
-}
-
-.inspector-config-viewer__list {
-  display: grid;
-  grid-template-columns: minmax(6rem, auto) 1fr;
-  gap: 0.15rem 0.5rem;
-}
-
-.inspector-config-viewer__key {
-  margin: 0;
-  color: #6c757d;
-  word-break: break-word;
-}
-
-.inspector-config-viewer__value {
-  margin: 0;
-  word-break: break-all;
-}
-
-.inspector-config-viewer__empty {
-  font-size: 0.75rem;
-}
-</style>

From 87098c804451688a677f4b7eb318735d43809ba2 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Thu, 12 Feb 2026 15:41:34 -0400
Subject: [PATCH 04/16] FOUR-29250 Require URL when External URL is selected in
 ElementDestination.

---
 src/components/inspectors/ElementDestination.vue | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/components/inspectors/ElementDestination.vue b/src/components/inspectors/ElementDestination.vue
index e5a51a37c..c138a814a 100644
--- a/src/components/inspectors/ElementDestination.vue
+++ b/src/components/inspectors/ElementDestination.vue
@@ -177,7 +177,11 @@ export default {
   },
   methods: {
     getValidationErrorForURL(url) {
-      if (!url || !url.trim()) {
+      const isEmpty = !url || !url.trim();
+      if (isEmpty) {
+        if (this.destinationType === 'externalURL') {
+          return this.$t('URL is required when External URL is selected.');
+        }
         return '';
       }
       if (!this.isValidURL(url)) {

From c02f982387c54a6899d3c27dfb1821da1eaf8454 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Thu, 12 Feb 2026 16:08:13 -0400
Subject: [PATCH 05/16] FOUR-29250 ElementDestination: improve URL validation

- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
---
 src/components/inspectors/ElementDestination.vue | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/components/inspectors/ElementDestination.vue b/src/components/inspectors/ElementDestination.vue
index c138a814a..caaf921dd 100644
--- a/src/components/inspectors/ElementDestination.vue
+++ b/src/components/inspectors/ElementDestination.vue
@@ -65,6 +65,9 @@
 import ProcessFormSelect from '@/components/inspectors/ProcessFormSelect';
 import debounce from 'lodash/debounce';
 import isEqual from 'lodash/isEqual';
+
+const MUSTACHE_PATTERN = /{{\s*[^}]+\s*}}/;
+
 export default {
   components: { ProcessFormSelect },
   props: {
@@ -177,7 +180,7 @@ export default {
   },
   methods: {
     getValidationErrorForURL(url) {
-      const isEmpty = !url || !url.trim();
+      const isEmpty = typeof url !== 'string' || !url || !url.trim();
       if (isEmpty) {
         if (this.destinationType === 'externalURL') {
           return this.$t('URL is required when External URL is selected.');
@@ -190,12 +193,12 @@ export default {
       return '';
     },
     isValidURL(string) {
-      if (!string || typeof string !== 'string') {
-        return true;
+      if (typeof string !== 'string' || !string.trim()) {
+        return false;
       }
-      // Allow Mustache: same context as backend (APP_URL, _request, _user, process variables)
+      // Allow Mustache: same context as backend ({{APP_URL}}, {{_request.id}}, {{_user.id}}, process variables)
       if (string.includes('{{')) {
-        return true;
+        return MUSTACHE_PATTERN.test(string);
       }
       try {
         new URL(string);

From fc7402d981dd864c6ea8c4d752719357a18e1dc7 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Thu, 12 Feb 2026 17:57:30 -0400
Subject: [PATCH 06/16] FOUR-29250 Fix ElementDestination URL validation
 message: keep Mustache examples outside $t() so {{APP_URL}}, {{_request.id}},
 {{_user.id}} display correctly.

---
 src/components/inspectors/ElementDestination.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/components/inspectors/ElementDestination.vue b/src/components/inspectors/ElementDestination.vue
index caaf921dd..afaa3ad0c 100644
--- a/src/components/inspectors/ElementDestination.vue
+++ b/src/components/inspectors/ElementDestination.vue
@@ -188,7 +188,7 @@ export default {
         return '';
       }
       if (!this.isValidURL(url)) {
-        return this.$t('Must be a valid URL or Mustache expressions ({{APP_URL}}, {{_request.id}}, {{_user.id}}, process variables).');
+        return this.$t('Must be a valid URL or Mustache expressions') + ' ({{APP_URL}}, {{_request.id}}, {{_user.id}}, ' + this.$t('process variables') + ').';
       }
       return '';
     },

From 80848ddd7e7c908eafa222ccce9784007ef4a4f4 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Sun, 22 Feb 2026 13:05:30 -0400
Subject: [PATCH 07/16] FOUR-29250 Refactor URL validation in
 ElementDestination and TaskDestination components

- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
---
 .../ConditionalRedirect/TaskDestination.vue   | 31 ++++++++++++-------
 .../inspectors/ElementDestination.vue         | 17 ++--------
 2 files changed, 21 insertions(+), 27 deletions(-)

diff --git a/src/components/inspectors/ConditionalRedirect/TaskDestination.vue b/src/components/inspectors/ConditionalRedirect/TaskDestination.vue
index ecec1c2b1..96dc26a4b 100644
--- a/src/components/inspectors/ConditionalRedirect/TaskDestination.vue
+++ b/src/components/inspectors/ConditionalRedirect/TaskDestination.vue
@@ -50,9 +50,9 @@
       v-if="taskDestination?.value === 'externalURL'"
       :label="$t('URL')"
       v-model="externalURL"
-      :error="getValidationErrorForCustomURL(externalURL)"
+      :error="getValidationErrorForURL(externalURL)"
       :placeholder="urlPlaceholder"
-      :helper="$t('Determine the URL where the request will end')"
+      :helper="externalUrlHelperText"
       data-test="conditional-task-external-url"
     />
 
@@ -79,6 +79,7 @@
 </template>
 
 <script>
+import { isValidElementDestinationURL } from '@/utils/elementDestinationUrl';
 import debounce from 'lodash/debounce';
 import isEqual from 'lodash/isEqual';
 import cloneDeep from 'lodash/cloneDeep';
@@ -119,6 +120,9 @@ export default {
     node() {
       return this.$root.$children[0].$refs.modeler.highlightedNode.definition;
     },
+    externalUrlHelperText() {
+      return this.$t('URL where the request will redirect. Supports Mustache:') + ' {{APP_URL}}, {{_request.id}}, {{_user.id}}, ' + this.$t('process variables.');
+    },
   },
   watch: {
     condition: {
@@ -193,18 +197,21 @@ export default {
     onRemoveCondition() {
       this.$emit('remove', this.conditionId);
     },
-    getValidationErrorForCustomURL(url) {
-      if (!url) return this.$t('URL is required');
-      if (!this.isValidCustomURL(url)) return this.$t('Must be a valid URL');
+    getValidationErrorForURL(url) {
+      const isEmpty = typeof url !== 'string' || !url || !url.trim();
+      if (isEmpty) {
+        if (this.taskDestination?.value === 'externalURL') {
+          return this.$t('URL is required when External URL is selected.');
+        }
+        return '';
+      }
+      if (!this.isValidURL(url)) {
+        return this.$t('Must be a valid URL or Mustache expressions') + ' ({{APP_URL}}, {{_request.id}}, {{_user.id}}, ' + this.$t('process variables') + ').';
+      }
       return '';
     },
-    isValidCustomURL(url) {
-      try {
-        const parsed = new URL(url);
-        return ['http:', 'https:'].includes(parsed.protocol);
-      } catch {
-        return false;
-      }
+    isValidURL(string) {
+      return isValidElementDestinationURL(string);
     },
     getCustomDashboards(filter) {
       this.loading = true;
diff --git a/src/components/inspectors/ElementDestination.vue b/src/components/inspectors/ElementDestination.vue
index afaa3ad0c..1e72a9320 100644
--- a/src/components/inspectors/ElementDestination.vue
+++ b/src/components/inspectors/ElementDestination.vue
@@ -63,11 +63,10 @@
 
 <script>
 import ProcessFormSelect from '@/components/inspectors/ProcessFormSelect';
+import { isValidElementDestinationURL } from '@/utils/elementDestinationUrl';
 import debounce from 'lodash/debounce';
 import isEqual from 'lodash/isEqual';
 
-const MUSTACHE_PATTERN = /{{\s*[^}]+\s*}}/;
-
 export default {
   components: { ProcessFormSelect },
   props: {
@@ -193,19 +192,7 @@ export default {
       return '';
     },
     isValidURL(string) {
-      if (typeof string !== 'string' || !string.trim()) {
-        return false;
-      }
-      // Allow Mustache: same context as backend ({{APP_URL}}, {{_request.id}}, {{_user.id}}, process variables)
-      if (string.includes('{{')) {
-        return MUSTACHE_PATTERN.test(string);
-      }
-      try {
-        new URL(string);
-        return true;
-      } catch (_) {
-        return false;
-      }
+      return isValidElementDestinationURL(string);
     },
     loadData() {
       this.optionsCopy = this.options.map(option => ({

From c3d28c947f7b6d84090d9dabd4a4aa41ab1e9c45 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Sun, 22 Feb 2026 13:08:29 -0400
Subject: [PATCH 08/16] FOUR-29250 Add isValidElementDestinationURL utility for
 validating Element Destination URLs

- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
---
 src/utils/elementDestinationUrl.js | 55 ++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 src/utils/elementDestinationUrl.js

diff --git a/src/utils/elementDestinationUrl.js b/src/utils/elementDestinationUrl.js
new file mode 100644
index 000000000..fa73e3f0e
--- /dev/null
+++ b/src/utils/elementDestinationUrl.js
@@ -0,0 +1,55 @@
+/**
+ * Valid Mustache placeholder: {{ variable }}.
+ * Variable: one or more non-whitespace characters (no spaces inside the name). Rejects {{}}, {{ }}, {{var2 var2}}.
+ */
+const MUSTACHE_PLACEHOLDER = /{{\s*\S+\s*}}/;
+
+/**
+ * Returns true if the string has only valid Mustache definitions (one or more) and no stray {{ or }}.
+ * Valid: {{var}}, {{ APP_URL }}, https://host/{{path}}, {{a}}{{b}}. Invalid: {{}}, {{ }}, {{unclosed, }}solo.
+ * @param {string} str - Non-empty trimmed string.
+ * @returns {boolean}
+ */
+function hasValidMustacheOnly(str) {
+  if (!str.includes('{{')) {
+    return false;
+  }
+  const globalRegex = new RegExp(MUSTACHE_PLACEHOLDER.source, 'g');
+  const withoutPlaceholders = str.replace(globalRegex, '');
+  const hasStrayBraces = withoutPlaceholders.includes('{{') || withoutPlaceholders.includes('}}');
+  if (hasStrayBraces) {
+    return false;
+  }
+  // No stray braces and string contained {{ → at least one valid placeholder was matched.
+  return true;
+}
+
+/**
+ * Validates Element Destination / Conditional Redirect URL field.
+ * 1. Must be a non-empty string.
+ * 2. If it contains {{: must be valid Mustache (one or more placeholders like {{var}}, no stray braces). Invalid Mustache → false (same as invalid URL).
+ * 3. If it does not contain {{: must be a valid URL.
+ *
+ * @param {string} value - Value to validate (URL or Mustache template).
+ * @returns {boolean}
+ */
+export function isValidElementDestinationURL(value) {
+  if (typeof value !== 'string') {
+    return false;
+  }
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return false;
+  }
+
+  if (trimmed.includes('{{')) {
+    return hasValidMustacheOnly(trimmed);
+  }
+
+  try {
+    new URL(trimmed);
+    return true;
+  } catch {
+    return false;
+  }
+}

From 507232574df7bfa036562d96731f723a21e842e8 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Mon, 23 Feb 2026 14:38:21 -0400
Subject: [PATCH 09/16] FOUR-29250 Update Mustache placeholder regex in
 elementDestinationUrl utility

- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
---
 src/utils/elementDestinationUrl.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/utils/elementDestinationUrl.js b/src/utils/elementDestinationUrl.js
index fa73e3f0e..4fd4b901f 100644
--- a/src/utils/elementDestinationUrl.js
+++ b/src/utils/elementDestinationUrl.js
@@ -1,8 +1,9 @@
 /**
  * Valid Mustache placeholder: {{ variable }}.
- * Variable: one or more non-whitespace characters (no spaces inside the name). Rejects {{}}, {{ }}, {{var2 var2}}.
+ * Variable: one or more non-whitespace characters excluding '}' (no spaces inside the name). Rejects {{}}, {{ }}, {{var2 var2}}.
+ * Uses [^\s}]+ for the variable to avoid ReDoS from backtracking between \s* and \S+.
  */
-const MUSTACHE_PLACEHOLDER = /{{\s*\S+\s*}}/;
+const MUSTACHE_PLACEHOLDER = /\{\{\s*[^\s}]+\s*\}\}/;
 
 /**
  * Returns true if the string has only valid Mustache definitions (one or more) and no stray {{ or }}.

From 81617140d11972b77b90d528fe9216bb2b810882 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Mon, 23 Feb 2026 15:01:26 -0400
Subject: [PATCH 10/16] FOUR-29250 Add unit tests for elementDestinationUrl
 validation

---
 tests/unit/elementDestinationUrl.spec.js | 85 ++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 tests/unit/elementDestinationUrl.spec.js

diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
new file mode 100644
index 000000000..03a86c1ea
--- /dev/null
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -0,0 +1,85 @@
+import { isValidElementDestinationURL } from '@/utils/elementDestinationUrl';
+
+describe('elementDestinationUrl', () => {
+  describe('isValidElementDestinationURL', () => {
+    describe('non-string or empty', () => {
+      it('returns false for non-string values', () => {
+        expect(isValidElementDestinationURL(null)).toBe(false);
+        expect(isValidElementDestinationURL(undefined)).toBe(false);
+        expect(isValidElementDestinationURL(123)).toBe(false);
+        expect(isValidElementDestinationURL({})).toBe(false);
+        expect(isValidElementDestinationURL([])).toBe(false);
+      });
+
+      it('returns false for empty string', () => {
+        expect(isValidElementDestinationURL('')).toBe(false);
+      });
+
+      it('returns false for whitespace-only string', () => {
+        expect(isValidElementDestinationURL('   ')).toBe(false);
+        expect(isValidElementDestinationURL('\t\n')).toBe(false);
+      });
+    });
+
+    describe('Mustache template (contains {{)', () => {
+      it('returns true for valid single placeholder', () => {
+        expect(isValidElementDestinationURL('{{var}}')).toBe(true);
+        expect(isValidElementDestinationURL('{{ APP_URL }}')).toBe(true);
+        expect(isValidElementDestinationURL('  {{path}}  ')).toBe(true);
+      });
+
+      it('returns true for valid multiple placeholders', () => {
+        expect(isValidElementDestinationURL('{{a}}{{b}}')).toBe(true);
+        expect(isValidElementDestinationURL('{{x}}/{{y}}')).toBe(true);
+      });
+
+      it('returns true for URL with valid Mustache placeholders', () => {
+        expect(isValidElementDestinationURL('https://host/{{path}}')).toBe(true);
+        expect(isValidElementDestinationURL('http://example.com/{{id}}/view')).toBe(true);
+      });
+
+      it('returns false for empty placeholder {{}}', () => {
+        expect(isValidElementDestinationURL('{{}}')).toBe(false);
+      });
+
+      it('returns false for placeholder with only spaces {{ }}', () => {
+        expect(isValidElementDestinationURL('{{ }}')).toBe(false);
+      });
+
+      it('returns false for unclosed Mustache (stray {{)', () => {
+        expect(isValidElementDestinationURL('{{unclosed')).toBe(false);
+        expect(isValidElementDestinationURL('{{a}} {{')).toBe(false);
+      });
+
+      it('returns false for stray closing braces }}', () => {
+        expect(isValidElementDestinationURL('{{a}} }}')).toBe(false);
+        expect(isValidElementDestinationURL('}}solo')).toBe(false);
+      });
+
+      it('returns false for placeholder with space inside variable name', () => {
+        expect(isValidElementDestinationURL('{{var2 var2}}')).toBe(false);
+      });
+    });
+
+    describe('plain URL (no Mustache)', () => {
+      it('returns true for valid HTTP URL', () => {
+        expect(isValidElementDestinationURL('http://example.com')).toBe(true);
+        expect(isValidElementDestinationURL('http://a.b')).toBe(true);
+      });
+
+      it('returns true for valid HTTPS URL', () => {
+        expect(isValidElementDestinationURL('https://example.com')).toBe(true);
+        expect(isValidElementDestinationURL('https://example.com/path?q=1')).toBe(true);
+      });
+
+      it('returns true for URL with trimmed whitespace', () => {
+        expect(isValidElementDestinationURL('  https://example.com  ')).toBe(true);
+      });
+
+      it('returns false for invalid URL', () => {
+        expect(isValidElementDestinationURL('not a url')).toBe(false);
+        expect(isValidElementDestinationURL('://bad')).toBe(false);
+      });
+    });
+  });
+});

From 5cced67b8826b4f7ffb7b51911ed24c7f4329a80 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Mon, 23 Feb 2026 16:04:57 -0400
Subject: [PATCH 11/16] FOUR-29250 Export hasValidMustacheOnly and add tests
 for full coverage.

---
 src/utils/elementDestinationUrl.js       |  4 ++--
 tests/unit/elementDestinationUrl.spec.js | 23 ++++++++++++++++++++++-
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/src/utils/elementDestinationUrl.js b/src/utils/elementDestinationUrl.js
index 4fd4b901f..f5579db99 100644
--- a/src/utils/elementDestinationUrl.js
+++ b/src/utils/elementDestinationUrl.js
@@ -11,7 +11,7 @@ const MUSTACHE_PLACEHOLDER = /\{\{\s*[^\s}]+\s*\}\}/;
  * @param {string} str - Non-empty trimmed string.
  * @returns {boolean}
  */
-function hasValidMustacheOnly(str) {
+export function hasValidMustacheOnly(str) {
   if (!str.includes('{{')) {
     return false;
   }
@@ -29,7 +29,7 @@ function hasValidMustacheOnly(str) {
  * Validates Element Destination / Conditional Redirect URL field.
  * 1. Must be a non-empty string.
  * 2. If it contains {{: must be valid Mustache (one or more placeholders like {{var}}, no stray braces). Invalid Mustache → false (same as invalid URL).
- * 3. If it does not contain {{: must be a valid URL.
+ * 3. If it does not contain {{: must be a valid URL. 
  *
  * @param {string} value - Value to validate (URL or Mustache template).
  * @returns {boolean}
diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
index 03a86c1ea..5d3c672a6 100644
--- a/tests/unit/elementDestinationUrl.spec.js
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -1,6 +1,27 @@
-import { isValidElementDestinationURL } from '@/utils/elementDestinationUrl';
+import {
+  isValidElementDestinationURL,
+  hasValidMustacheOnly,
+} from '@/utils/elementDestinationUrl';
 
 describe('elementDestinationUrl', () => {
+  describe('hasValidMustacheOnly', () => {
+    it('returns false when string does not contain {{', () => {
+      expect(hasValidMustacheOnly('no mustache here')).toBe(false);
+      expect(hasValidMustacheOnly('https://example.com')).toBe(false);
+    });
+
+    it('returns true when string has only valid placeholders', () => {
+      expect(hasValidMustacheOnly('{{var}}')).toBe(true);
+      expect(hasValidMustacheOnly('{{a}}{{b}}')).toBe(true);
+    });
+
+    it('returns false when string has stray {{ or }}', () => {
+      expect(hasValidMustacheOnly('{{}}')).toBe(false);
+      expect(hasValidMustacheOnly('{{unclosed')).toBe(false);
+      expect(hasValidMustacheOnly('{{a}} }}')).toBe(false);
+    });
+  });
+
   describe('isValidElementDestinationURL', () => {
     describe('non-string or empty', () => {
       it('returns false for non-string values', () => {

From cbdf52badfb16b0014b65e74188e4af1528dc659 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Tue, 24 Feb 2026 10:19:12 -0400
Subject: [PATCH 12/16] FOUR-29250 Reject empty mustache {{}} in URL validation
 and add tests

- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
---
 src/utils/elementDestinationUrl.js       |  6 ++++++
 tests/unit/elementDestinationUrl.spec.js | 18 +++++++++++++++---
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/utils/elementDestinationUrl.js b/src/utils/elementDestinationUrl.js
index f5579db99..76a197820 100644
--- a/src/utils/elementDestinationUrl.js
+++ b/src/utils/elementDestinationUrl.js
@@ -5,6 +5,9 @@
  */
 const MUSTACHE_PLACEHOLDER = /\{\{\s*[^\s}]+\s*\}\}/;
 
+/** Empty or space-only mustache: invalid. */
+const EMPTY_MUSTACHE = /\{\{\s*\}\}/;
+
 /**
  * Returns true if the string has only valid Mustache definitions (one or more) and no stray {{ or }}.
  * Valid: {{var}}, {{ APP_URL }}, https://host/{{path}}, {{a}}{{b}}. Invalid: {{}}, {{ }}, {{unclosed, }}solo.
@@ -15,6 +18,9 @@ export function hasValidMustacheOnly(str) {
   if (!str.includes('{{')) {
     return false;
   }
+  if (EMPTY_MUSTACHE.test(str)) {
+    return false;
+  }
   const globalRegex = new RegExp(MUSTACHE_PLACEHOLDER.source, 'g');
   const withoutPlaceholders = str.replace(globalRegex, '');
   const hasStrayBraces = withoutPlaceholders.includes('{{') || withoutPlaceholders.includes('}}');
diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
index 5d3c672a6..4fe7bc788 100644
--- a/tests/unit/elementDestinationUrl.spec.js
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -15,11 +15,19 @@ describe('elementDestinationUrl', () => {
       expect(hasValidMustacheOnly('{{a}}{{b}}')).toBe(true);
     });
 
-    it('returns false when string has stray {{ or }}', () => {
+    it('returns false when string contains empty mustache {{}} or {{ }}', () => {
       expect(hasValidMustacheOnly('{{}}')).toBe(false);
-      expect(hasValidMustacheOnly('{{unclosed')).toBe(false);
-      expect(hasValidMustacheOnly('{{a}} }}')).toBe(false);
+      expect(hasValidMustacheOnly('{{ }}')).toBe(false);
     });
+
+      it('returns false when string has stray {{ or }}', () => {
+        expect(hasValidMustacheOnly('{{unclosed')).toBe(false);
+        expect(hasValidMustacheOnly('{{a}} }}')).toBe(false);
+      });
+
+      it('returns false when valid placeholders are followed by empty {{}}', () => {
+        expect(hasValidMustacheOnly('{{server}}/{{_request.id}}{{}}')).toBe(false);
+      });
   });
 
   describe('isValidElementDestinationURL', () => {
@@ -80,6 +88,10 @@ describe('elementDestinationUrl', () => {
       it('returns false for placeholder with space inside variable name', () => {
         expect(isValidElementDestinationURL('{{var2 var2}}')).toBe(false);
       });
+
+      it('returns false for URL with valid placeholders plus empty {{}}', () => {
+        expect(isValidElementDestinationURL('{{server}}/{{_request.id}}{{}}')).toBe(false);
+      });
     });
 
     describe('plain URL (no Mustache)', () => {

From 3de027462dbb69600ad925ec279ce439ed790c12 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Tue, 24 Feb 2026 10:23:16 -0400
Subject: [PATCH 13/16] FOUR-29250 Add tests for empty mustache validation and
 fix indent in elementDestinationUrl spec

---
 tests/unit/elementDestinationUrl.spec.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
index 4fe7bc788..b1aeec80b 100644
--- a/tests/unit/elementDestinationUrl.spec.js
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -20,14 +20,14 @@ describe('elementDestinationUrl', () => {
       expect(hasValidMustacheOnly('{{ }}')).toBe(false);
     });
 
-      it('returns false when string has stray {{ or }}', () => {
-        expect(hasValidMustacheOnly('{{unclosed')).toBe(false);
-        expect(hasValidMustacheOnly('{{a}} }}')).toBe(false);
-      });
+    it('returns false when string has stray {{ or }}', () => {
+      expect(hasValidMustacheOnly('{{unclosed')).toBe(false);
+      expect(hasValidMustacheOnly('{{a}} }}')).toBe(false);
+    });
 
-      it('returns false when valid placeholders are followed by empty {{}}', () => {
-        expect(hasValidMustacheOnly('{{server}}/{{_request.id}}{{}}')).toBe(false);
-      });
+    it('returns false when valid placeholders are followed by empty {{}}', () => {
+      expect(hasValidMustacheOnly('{{server}}/{{_request.id}}{{}}')).toBe(false);
+    });
   });
 
   describe('isValidElementDestinationURL', () => {

From cb9d8d7c143717263c300630c1d005f58b506821 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Tue, 24 Feb 2026 13:31:58 -0400
Subject: [PATCH 14/16] FOUR-29250 Improve elementDestinationUrl unit tests:
 add file comment, new cases, and split/clarify specs.

---
 tests/unit/elementDestinationUrl.spec.js | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
index b1aeec80b..bb7d91b35 100644
--- a/tests/unit/elementDestinationUrl.spec.js
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -1,3 +1,7 @@
+/**
+ * Tests for elementDestinationUrl utils (hasValidMustacheOnly, isValidElementDestinationURL).
+ * Written for 100% line and branch coverage of src/utils/elementDestinationUrl.js.
+ */
 import {
   isValidElementDestinationURL,
   hasValidMustacheOnly,
@@ -15,13 +19,20 @@ describe('elementDestinationUrl', () => {
       expect(hasValidMustacheOnly('{{a}}{{b}}')).toBe(true);
     });
 
+    it('returns true for placeholder with spaces around variable name', () => {
+      expect(hasValidMustacheOnly('{{  x  }}')).toBe(true);
+    });
+
     it('returns false when string contains empty mustache {{}} or {{ }}', () => {
       expect(hasValidMustacheOnly('{{}}')).toBe(false);
       expect(hasValidMustacheOnly('{{ }}')).toBe(false);
     });
 
-    it('returns false when string has stray {{ or }}', () => {
+    it('returns false when string has stray {{ (unclosed)', () => {
       expect(hasValidMustacheOnly('{{unclosed')).toBe(false);
+    });
+
+    it('returns false when string has stray }} after valid placeholder', () => {
       expect(hasValidMustacheOnly('{{a}} }}')).toBe(false);
     });
 
@@ -36,6 +47,7 @@ describe('elementDestinationUrl', () => {
         expect(isValidElementDestinationURL(null)).toBe(false);
         expect(isValidElementDestinationURL(undefined)).toBe(false);
         expect(isValidElementDestinationURL(123)).toBe(false);
+        expect(isValidElementDestinationURL(false)).toBe(false);
         expect(isValidElementDestinationURL({})).toBe(false);
         expect(isValidElementDestinationURL([])).toBe(false);
       });
@@ -109,7 +121,7 @@ describe('elementDestinationUrl', () => {
         expect(isValidElementDestinationURL('  https://example.com  ')).toBe(true);
       });
 
-      it('returns false for invalid URL', () => {
+      it('returns false for invalid URL (exercises catch branch)', () => {
         expect(isValidElementDestinationURL('not a url')).toBe(false);
         expect(isValidElementDestinationURL('://bad')).toBe(false);
       });

From acc032fda8bbff498dc42c0f9ab002d86ebed012 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Wed, 25 Feb 2026 10:14:05 -0400
Subject: [PATCH 15/16] FOUR-29250 Strict mustache URL validation and tests

- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals
---
 src/utils/elementDestinationUrl.js       | 46 +++++++++++-------------
 tests/unit/elementDestinationUrl.spec.js | 24 +++++++++++++
 2 files changed, 44 insertions(+), 26 deletions(-)

diff --git a/src/utils/elementDestinationUrl.js b/src/utils/elementDestinationUrl.js
index 76a197820..17032c2e8 100644
--- a/src/utils/elementDestinationUrl.js
+++ b/src/utils/elementDestinationUrl.js
@@ -1,43 +1,37 @@
-/**
- * Valid Mustache placeholder: {{ variable }}.
- * Variable: one or more non-whitespace characters excluding '}' (no spaces inside the name). Rejects {{}}, {{ }}, {{var2 var2}}.
- * Uses [^\s}]+ for the variable to avoid ReDoS from backtracking between \s* and \S+.
- */
+/** Matches one Mustache placeholder {{ variable }}. Variable: [^\s}]+ (no spaces, no '}'). Rejects {{}}, {{ }}, {{a b}}. */
 const MUSTACHE_PLACEHOLDER = /\{\{\s*[^\s}]+\s*\}\}/;
 
-/** Empty or space-only mustache: invalid. */
-const EMPTY_MUSTACHE = /\{\{\s*\}\}/;
+/** Matches URL scheme at start (e.g. http:, https:). */
+const HAS_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
 
 /**
- * Returns true if the string has only valid Mustache definitions (one or more) and no stray {{ or }}.
- * Valid: {{var}}, {{ APP_URL }}, https://host/{{path}}, {{a}}{{b}}. Invalid: {{}}, {{ }}, {{unclosed, }}solo.
+ * True when the string has only valid Mustache placeholders and the literal parts form a valid URL.
+ * Rejects empty mustache ({{}}, {{ }}), stray { or }, and invalid URL characters.
+ *
  * @param {string} str - Non-empty trimmed string.
  * @returns {boolean}
  */
 export function hasValidMustacheOnly(str) {
-  if (!str.includes('{{')) {
-    return false;
-  }
-  if (EMPTY_MUSTACHE.test(str)) {
-    return false;
-  }
-  const globalRegex = new RegExp(MUSTACHE_PLACEHOLDER.source, 'g');
-  const withoutPlaceholders = str.replace(globalRegex, '');
-  const hasStrayBraces = withoutPlaceholders.includes('{{') || withoutPlaceholders.includes('}}');
-  if (hasStrayBraces) {
+  if (!str.includes('{{')) return false;
+
+  const g = new RegExp(MUSTACHE_PLACEHOLDER.source, 'g');
+  const urlSkeleton = str.replace(g, 'a');
+  if (urlSkeleton.includes('{') || urlSkeleton.includes('}')) return false;
+
+  const urlToTest = HAS_SCHEME.test(urlSkeleton) ? urlSkeleton : `http://${urlSkeleton}`;
+  try {
+    new URL(urlToTest);
+    return true;
+  } catch {
     return false;
   }
-  // No stray braces and string contained {{ → at least one valid placeholder was matched.
-  return true;
 }
 
 /**
- * Validates Element Destination / Conditional Redirect URL field.
- * 1. Must be a non-empty string.
- * 2. If it contains {{: must be valid Mustache (one or more placeholders like {{var}}, no stray braces). Invalid Mustache → false (same as invalid URL).
- * 3. If it does not contain {{: must be a valid URL. 
+ * Validates the Element Destination / Conditional Redirect URL field.
+ * (1) Non-empty string. (2) If it contains {{: only valid Mustache placeholders and URL-valid literals. (3) Else: valid URL.
  *
- * @param {string} value - Value to validate (URL or Mustache template).
+ * @param {string} value - URL or Mustache template to validate.
  * @returns {boolean}
  */
 export function isValidElementDestinationURL(value) {
diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
index bb7d91b35..ba2f5a947 100644
--- a/tests/unit/elementDestinationUrl.spec.js
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -39,6 +39,25 @@ describe('elementDestinationUrl', () => {
     it('returns false when valid placeholders are followed by empty {{}}', () => {
       expect(hasValidMustacheOnly('{{server}}/{{_request.id}}{{}}')).toBe(false);
     });
+
+    it('returns false when skeleton has stray single { or }', () => {
+      expect(hasValidMustacheOnly('{{v}} {')).toBe(false);
+      expect(hasValidMustacheOnly('https://127.0.0.5:8092/admin/users/12/edit{{v}} {{v}} {')).toBe(false);
+    });
+
+    it('returns false when literal parts form invalid URL', () => {
+      expect(hasValidMustacheOnly('{{variable}} / `[[[][∫ad')).toBe(false);
+      expect(hasValidMustacheOnly('{{x}}`invalid')).toBe(false);
+    });
+
+    it('returns true when URL has scheme (HAS_SCHEME branch)', () => {
+      expect(hasValidMustacheOnly('https://host/{{path}}')).toBe(true);
+      expect(hasValidMustacheOnly('http://example.com/{{id}}/view')).toBe(true);
+    });
+
+    it('returns true when no scheme so http:// is prepended', () => {
+      expect(hasValidMustacheOnly('{{host}}/path')).toBe(true);
+    });
   });
 
   describe('isValidElementDestinationURL', () => {
@@ -104,6 +123,11 @@ describe('elementDestinationUrl', () => {
       it('returns false for URL with valid placeholders plus empty {{}}', () => {
         expect(isValidElementDestinationURL('{{server}}/{{_request.id}}{{}}')).toBe(false);
       });
+
+      it('returns false when literal parts form invalid URL', () => {
+        expect(isValidElementDestinationURL('https://127.0.0.5:8092/admin/users/12/edit{{v}} {{v}} {')).toBe(false);
+        expect(isValidElementDestinationURL('{{variable}} / `[[[][∫ad')).toBe(false);
+      });
     });
 
     describe('plain URL (no Mustache)', () => {

From c1374e62edbc09efa8d9e4fc30e7cff1558c4188 Mon Sep 17 00:00:00 2001
From: Roly Gutierrez <roly.gutierrez@processmaker.com>
Date: Wed, 25 Feb 2026 10:23:35 -0400
Subject: [PATCH 16/16] FOUR-29250 Add tests for mustache URL validation (stray
 braces, invalid literals, scheme branches)

---
 tests/unit/elementDestinationUrl.spec.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/unit/elementDestinationUrl.spec.js b/tests/unit/elementDestinationUrl.spec.js
index ba2f5a947..27115bc53 100644
--- a/tests/unit/elementDestinationUrl.spec.js
+++ b/tests/unit/elementDestinationUrl.spec.js
@@ -47,7 +47,6 @@ describe('elementDestinationUrl', () => {
 
     it('returns false when literal parts form invalid URL', () => {
       expect(hasValidMustacheOnly('{{variable}} / `[[[][∫ad')).toBe(false);
-      expect(hasValidMustacheOnly('{{x}}`invalid')).toBe(false);
     });
 
     it('returns true when URL has scheme (HAS_SCHEME branch)', () => {