public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-09-14 20:42:04 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #276 from basecamp/card-7348960853-room-render-injection

Browse Source 
Render link previews only from web URLs
This commit is contained in:
Rosa Gutierrez
2026-09-11 21:29:14 +02:00
committed by GitHub
parent 5742dfaf73 436ea06457
commit 977cbcd135
5 changed files with 200 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/controllers/rooms_controller_test.rb
+51
View File
@@ -20,6 +20,51 @@ class RoomsControllerTest < ActionDispatch::IntegrationTest
assert response.cookies[:last_room] = users(:david).rooms.last.id
end
test "show renders a link preview written by hand without its off-scheme image and link" do
room = rooms(:watercooler)
post room_messages_url(room, format: :turbo_stream), params: { message: {
body: link_preview_body(href: "javascript:alert(1)", url: "data:image/svg+xml;base64,PHN2Zy8+"),
client_message_id: "hand-written-preview" } }
assert_response :success
get room_url(room)
assert_response :success
assert_no_match /javascript:alert/, response.body
assert_no_match /data:image\/svg/, response.body
assert_match "Free cookies", response.body
end
test "show renders a link preview written by hand without its image pointed at this Campfire" do
room = rooms(:watercooler)
own_url = room_url(room, host: "www.example.com")
post room_messages_url(room, format: :turbo_stream), params: { message: {
body: link_preview_body(href: own_url, url: own_url),
client_message_id: "same-host-preview" } }
assert_response :success
get room_url(room)
assert_response :success
assert_no_match %r{<img src="#{Regexp.escape(own_url)}"}, response.body
assert_no_match %r{<a rel="noreferrer" target="_blank" href="#{Regexp.escape(own_url)}"}, response.body
assert_match "Free cookies", response.body
end
test "show renders an unfurled link preview" do
room = rooms(:watercooler)
post room_messages_url(room, format: :turbo_stream), params: { message: {
body: link_preview_body(href: "https://example.com/page", url: "https://example.com/image.png"),
client_message_id: "unfurled-preview" } }
assert_response :success
get room_url(room)
assert_response :success
assert_match %r{<img src="https://example\.com/image\.png"}, response.body
assert_match %r{href="https://example\.com/page"}, response.body
end
test "destroy" do
assert_turbo_stream_broadcasts :rooms, count: 1 do
assert_difference -> { Room.count }, -1 do
@@ -42,4 +87,10 @@ class RoomsControllerTest < ActionDispatch::IntegrationTest
delete room_url(rooms(:designers))
end
end
private
def link_preview_body(href:, url:)
%(<div><action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" ) +
%(href="#{href}" url="#{url}" filename="Free cookies" caption="Cookies here"></action-text-attachment></div>)
end
end