Adapt the Lexxy composer to main's link preview hardening

Main strips a javascript: href from a preview node before it's parsed, so
tell legacy Trix attachments apart by their filename instead. escapeHTML
moved to the string helpers, and the unfurling system test now drives
the Lexxy editor.
This commit is contained in:
Stanko K.R.
2026-09-26 09:26:53 +02:00
parent 1bb7ef7c17
commit eab554aa4b
3 changed files with 5 additions and 17 deletions
@@ -1,7 +1,6 @@
import { Controller } from "@hotwired/stimulus"
import { post } from "@rails/request.js"
import { truncateString } from "helpers/string_helpers"
import { escapeHTML } from "helpers/dom_helpers"
import { escapeHTML, truncateString } from "helpers/string_helpers"
const OPENGRAPH_EMBED_CONTENT_TYPE = "application/vnd.actiontext.opengraph-embed"
+1 -1
View File
@@ -20,7 +20,7 @@ class ActionText::Attachment::OpengraphEmbed
# and content-type, so newer attachments carry the details in their
# content markup instead.
def attributes_from_node(node)
if node["href"].present?
if node["filename"].present?
{
href: web_url(node["href"]),
url: web_url(node["url"]),
+3 -14
View File
@@ -16,29 +16,18 @@ class UnfurlingLinksTest < ApplicationSystemTestCase
end
test "a quote in the opengraph image URL cannot add attributes to the preview" do
paste_into_composer @website.page_url
paste_in_composer @website.page_url
assert_selector "trix-editor .og-embed__title", text: "A normal looking link"
assert_selector "#composer lexxy-editor .og-embed__title", text: "A normal looking link"
assert_equal @website.image_url, preview_image_attributes["src"]
assert_empty preview_image_attributes.keys - %w[ src class alt ]
end
private
def paste_into_composer(url)
page.execute_script(<<~JS, url)
const editor = document.querySelector("trix-editor")
editor.focus()
const clipboardData = new DataTransfer()
clipboardData.setData("text/plain", arguments[0])
editor.dispatchEvent(new ClipboardEvent("paste", { clipboardData, bubbles: true, cancelable: true }))
JS
end
def preview_image_attributes
page.evaluate_script(<<~JS)
Object.fromEntries(Array.from(document.querySelector("trix-editor .og-embed__image img").attributes, attribute => [ attribute.name, attribute.value ]))
Object.fromEntries(Array.from(document.querySelector("#composer lexxy-editor .og-embed__image img").attributes, attribute => [ attribute.name, attribute.value ]))
JS
end