mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-09-19 14:54:55 +09:00
Compare a preview's host to ours with the escapes resolved
Ruby leaves a percent-escape in URI#host, so "https://%77ww.example.com" read as a different host than the one Campfire answers on while a browser unescaped it straight back to us. A host that carries an escape, or a trailing dot, is now measured the way the browser will read it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt
This commit is contained in:
@@ -38,9 +38,17 @@ class ActionText::Attachment::OpengraphEmbed
|
||||
|
||||
# "https:/rooms/1" parses as HTTPS with no host at all, and a browser
|
||||
# resolves both that and our own hostname against the origin Campfire is
|
||||
# served from.
|
||||
# served from. A percent-escape hides our hostname from this comparison
|
||||
# while a browser still unescapes it back to us, so an escaped host is out
|
||||
# too, and neither case is anything an unfurl could have produced.
|
||||
def elsewhere?(host)
|
||||
host.present? && !host.casecmp?(Current.request_host.to_s)
|
||||
return false if host.blank? || host.include?("%")
|
||||
|
||||
canonical_host(host) != canonical_host(Current.request_host.to_s)
|
||||
end
|
||||
|
||||
def canonical_host(host)
|
||||
host.downcase.delete_suffix(".")
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
Reference in New Issue
Block a user