Rosa Gutierrez ef4b88d748 Compare a preview's host to ours with the escapes resolved ...

Ruby leaves a percent-escape in URI#host, so "https://%77ww.example.com"
read as a different host than the one Campfire answers on while a browser
unescaped it straight back to us. A host that carries an escape, or a
trailing dot, is now measured the way the browser will read it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

2026-09-11 19:14:59 +02:00

..

channels

Scope the unread rooms stream per user

2026-08-03 14:55:19 -07:00

controllers

Keep a link preview's link and image off this Campfire's own host

2026-09-11 19:08:54 +02:00

fixtures

Allow bots to delete their own boosts

2026-08-11 14:13:01 +02:00

helpers

Harden message content filtering + bump thruster to 0.1.23 (#237)

2026-08-10 15:55:02 -07:00

lib

Compare a preview's host to ours with the escapes resolved

2026-09-11 19:14:59 +02:00

models

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

performance

Hello world

2025-08-21 09:31:59 +01:00

system

Hello world

2025-08-21 09:31:59 +01:00

test_helpers

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

application_system_test_case.rb

Hello world

2025-08-21 09:31:59 +01:00

test_helper.rb

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00