Rosa Gutierrez c3ae67a2b6 Require a host on a link preview's link and image ...

Ruby parses "https:/rooms/1" as an HTTPS URL with no host, and a browser
resolves it against whatever origin Campfire is served from, so the scheme
check alone still let a message body aim the preview at a path here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

2026-09-11 19:02:25 +02:00

..

assets

Hello world

2025-08-21 09:31:59 +01:00

rails_ext

Require a host on a link preview's link and image

2026-09-11 19:02:25 +02:00

restricted_http

Take the SSRF address policy from surfguard instead of keeping our own copy (#241)

2026-08-20 01:59:19 -07:00

tasks

Upgrade to Rails 8 and Ruby 3.4.5 (#1)

2025-09-02 17:02:41 +02:00

web_push

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00