public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-09-17 05:52:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

Read a preview's host as a name by its last label

Browse Source 
A domain name ends in a word, which is what keeps it from reading as an
address. "0x7f.0.0.1" carries a dot and a letter, so the previous shape
check let it through while a browser fetched 127.0.0.1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt
This commit is contained in:
Rosa Gutierrez
2026-09-11 20:25:35 +02:00
parent 9e19658ee0
commit 436ea06457
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/rails_ext/actiontext_opengraph_embeds.rb
+9 -3
View File
@@ -48,11 +48,17 @@ class ActionText::Attachment::OpengraphEmbed
end
# A preview names a page on the public internet, so its host is a domain
# name: it has a dot and a letter in it, and no escapes. A bare address is
# not one, and a browser rewrites the many spellings of an address into a
# name, written plainly. A bare address is not one, and a browser rewrites
# the many spellings of an address ("2130706433", "0x7f.0.0.1") into a
# single one before it fetches, which is a race a comparison here loses.
def named_host?(host)
host.present? && host.exclude?("%") && host.include?(".") && host.match?(/[a-z]/i)
host.present? && host.exclude?("%") && host.include?(".") && domain_ending?(host.split(".").last)
end
# What keeps a name from reading as an address is its last label, which is
# a word: never a number, and never the hexadecimal spelling of one.
def domain_ending?(label)
label.match?(/[a-z]/i) && !label.match?(/\A0x/i)
end
def canonical_host(host)