mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-09-27 18:46:23 +09:00
Adapt the Lexxy composer to main's link preview hardening
Main strips a javascript: href from a preview node before it's parsed, so tell legacy Trix attachments apart by their filename instead. escapeHTML moved to the string helpers, and the unfurling system test now drives the Lexxy editor.
This commit is contained in:
@@ -1,7 +1,6 @@
|
||||
import { Controller } from "@hotwired/stimulus"
|
||||
import { post } from "@rails/request.js"
|
||||
import { truncateString } from "helpers/string_helpers"
|
||||
import { escapeHTML } from "helpers/dom_helpers"
|
||||
import { escapeHTML, truncateString } from "helpers/string_helpers"
|
||||
|
||||
const OPENGRAPH_EMBED_CONTENT_TYPE = "application/vnd.actiontext.opengraph-embed"
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ class ActionText::Attachment::OpengraphEmbed
|
||||
# and content-type, so newer attachments carry the details in their
|
||||
# content markup instead.
|
||||
def attributes_from_node(node)
|
||||
if node["href"].present?
|
||||
if node["filename"].present?
|
||||
{
|
||||
href: web_url(node["href"]),
|
||||
url: web_url(node["url"]),
|
||||
|
||||
@@ -16,29 +16,18 @@ class UnfurlingLinksTest < ApplicationSystemTestCase
|
||||
end
|
||||
|
||||
test "a quote in the opengraph image URL cannot add attributes to the preview" do
|
||||
paste_into_composer @website.page_url
|
||||
paste_in_composer @website.page_url
|
||||
|
||||
assert_selector "trix-editor .og-embed__title", text: "A normal looking link"
|
||||
assert_selector "#composer lexxy-editor .og-embed__title", text: "A normal looking link"
|
||||
|
||||
assert_equal @website.image_url, preview_image_attributes["src"]
|
||||
assert_empty preview_image_attributes.keys - %w[ src class alt ]
|
||||
end
|
||||
|
||||
private
|
||||
def paste_into_composer(url)
|
||||
page.execute_script(<<~JS, url)
|
||||
const editor = document.querySelector("trix-editor")
|
||||
editor.focus()
|
||||
|
||||
const clipboardData = new DataTransfer()
|
||||
clipboardData.setData("text/plain", arguments[0])
|
||||
editor.dispatchEvent(new ClipboardEvent("paste", { clipboardData, bubbles: true, cancelable: true }))
|
||||
JS
|
||||
end
|
||||
|
||||
def preview_image_attributes
|
||||
page.evaluate_script(<<~JS)
|
||||
Object.fromEntries(Array.from(document.querySelector("trix-editor .og-embed__image img").attributes, attribute => [ attribute.name, attribute.value ]))
|
||||
Object.fromEntries(Array.from(document.querySelector("#composer lexxy-editor .og-embed__image img").attributes, attribute => [ attribute.name, attribute.value ]))
|
||||
JS
|
||||
end
|
||||
|
||||
|
||||
Reference in New Issue
Block a user