Rosa Gutierrez 3a501cd32c Render link previews only from web URLs ...

A link preview's link and image come from attributes on the message body,
which the composer fills in from the unfurl the server performed. A body
written by hand can put anything in those attributes, and the preview
partial rendered them as they were.

Keep the link and the image only when they parse as absolute http or https
URLs, so nothing in a message body can aim either one at another scheme or
at a path on this Campfire, and render the title and the description as
text.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

2026-09-11 18:58:04 +02:00

..

action_text_attachables.rb

Try to decode SGIDs in multiple ways

2025-12-15 17:00:50 +01:00

actiontext_opengraph_embeds.rb

Render link previews only from web URLs

2026-09-11 18:58:04 +02:00

filter.rb

Hello world

2025-08-21 09:31:59 +01:00

filters.rb

Hello world

2025-08-21 09:31:59 +01:00

log_scrubbing_formatter.rb

Redact bot key from request logs (#269)

2026-09-01 12:40:55 -07:00

string.rb

Hello world

2025-08-21 09:31:59 +01:00