public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-09-18 14:32:03 +09:00
Code Issues Packages Projects Releases Wiki Activity

Require a host on a link preview's link and image

Browse Source 
Ruby parses "https:/rooms/1" as an HTTPS URL with no host, and a browser
resolves it against whatever origin Campfire is served from, so the scheme
check alone still let a message body aim the preview at a path here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt
This commit is contained in:
Rosa Gutierrez
2026-09-11 19:02:25 +02:00
parent 3a501cd32c
commit c3ae67a2b6
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/lib/rails_ext/actiontext_opengraph_embeds_test.rb
+2 -1
View File
@@ -10,7 +10,8 @@ class ActionText::Attachment::OpengraphEmbedTest < ActiveSupport::TestCase
test "drops a link and an image that aren't web URLs" do
[ "javascript:alert(1)", "data:text/html,pwned", "vbscript:msgbox(1)", "//example.com/image.png",
"/rooms/1", "rooms/1", "", "http://exa mple.com/ " ].each do |value|
"/rooms/1", "rooms/1", "", "http://exa mple.com/ ",
"https:/rooms/1", "https:rooms/1", "http:/rooms/1", "https://", "http://:80/rooms/1" ].each do |value|
embed = embed_from href: value, url: value
assert_nil embed.href, "expected #{value.inspect} to be dropped as a link"