Rosa Gutierrez c3ae67a2b6 Require a host on a link preview's link and image ...

Ruby parses "https:/rooms/1" as an HTTPS URL with no host, and a browser
resolves it against whatever origin Campfire is served from, so the scheme
check alone still let a message body aim the preview at a path here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

2026-09-11 19:02:25 +02:00

..

channels

Scope the unread rooms stream per user

2026-08-03 14:55:19 -07:00

controllers

Render link previews only from web URLs

2026-09-11 18:58:04 +02:00

fixtures

Allow bots to delete their own boosts

2026-08-11 14:13:01 +02:00

helpers

Harden message content filtering + bump thruster to 0.1.23 (#237)

2026-08-10 15:55:02 -07:00

lib

Require a host on a link preview's link and image

2026-09-11 19:02:25 +02:00

models

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

performance

Hello world

2025-08-21 09:31:59 +01:00

system

Hello world

2025-08-21 09:31:59 +01:00

test_helpers

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

application_system_test_case.rb

Hello world

2025-08-21 09:31:59 +01:00

test_helper.rb

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00