public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-09-14 04:22:04 +09:00
Code Issues Packages Projects Releases Wiki Activity

Keep a link preview's link and image off this Campfire's own host

Browse Source 
A preview belongs to the page it previews, so both URLs point somewhere
else. An absolute URL on our own host passed the scheme and host checks,
and every reader's browser fetched it with their session attached, which
turns a message into a GET request made on the reader's behalf.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt
This commit is contained in:
Rosa Gutierrez
2026-09-11 19:08:54 +02:00
parent c3ae67a2b6
commit eceec2898b
3 changed files with 44 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/controllers/rooms_controller_test.rb
+16
View File
@@ -35,6 +35,22 @@ class RoomsControllerTest < ActionDispatch::IntegrationTest
assert_match "Free cookies", response.body
end
test "show renders a link preview written by hand without its image pointed at this Campfire" do
room = rooms(:watercooler)
own_url = room_url(room, host: "www.example.com")
post room_messages_url(room, format: :turbo_stream), params: { message: {
body: link_preview_body(href: own_url, url: own_url),
client_message_id: "same-host-preview" } }
assert_response :success
get room_url(room)
assert_response :success
assert_no_match %r{<img src="#{Regexp.escape(own_url)}"}, response.body
assert_no_match %r{<a rel="noreferrer" target="_blank" href="#{Regexp.escape(own_url)}"}, response.body
assert_match "Free cookies", response.body
end
test "show renders an unfurled link preview" do
room = rooms(:watercooler)
post room_messages_url(room, format: :turbo_stream), params: { message: {