fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286)

Previews are built from the plain body, clicks follow formatted_body's
hrefs, and a sender controls both: text "https://paypal.com" linked to
evil.example showed a real PayPal card. Drop body URLs whose site is
only claimed by the visible text of a mismatched link (linkSafety).

Fixes #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/components/message/MsgTypeRenderers.tsx

@@ -40,6 +40,7 @@ import { parseGeoUri, scaleYDimension } from '../../utils/common';
 import { formatAccuracy } from '../../utils/geoShare';
 import { Attachment, AttachmentBox, AttachmentContent, AttachmentHeader } from './attachment';
 import { FileHeader, FileDownloadButton } from './FileHeader';
+import { previewUrlsFor } from '../../utils/linkSafety';
 
 // ≈ 20 lines; in rem so a larger font setting doesn't show fewer lines (Gitea #343).
 const COLLAPSE_MAX_HEIGHT_REM = 20;
@@ -343,7 +344,13 @@ export function MText({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>
@@ -401,7 +408,13 @@ export function MEmote({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>
@@ -458,7 +471,13 @@ export function MNotice({
   if (typeof body !== 'string') return <BrokenContent />;
   const trimmedBody = trimReplyFromBody(body);
   const urlsMatch = renderUrlsPreview && trimmedBody.match(URL_REG);
-  const urls = urlsMatch ? [...new Set(urlsMatch)] : undefined;
+  // [Gitea #286] no genuine card for a site a deceptive link only pretends to be
+  const urls = urlsMatch
+    ? previewUrlsFor(
+        [...new Set(urlsMatch)],
+        typeof customBody === 'string' ? customBody : undefined,
+      )
+    : undefined;
 
   return (
     <>

src/app/features/shortcuts/KeyboardShortcutsDialog.tsx

@@ -25,9 +25,6 @@ import { settingsAtom } from '../../state/settings';
 import { isMacOS } from '../../utils/user-agent';
 import { KeySymbol } from '../../utils/key-symbol';
 import * as css from './KeyboardShortcutsDialog.css';
-import { BLOCK_HOTKEYS, INLINE_HOTKEYS } from '../../components/editor/keyboard';
-import { MarkType } from '../../components/editor/types';
-import { BLOCK_LABELS, MARK_LABELS, hotkeyKeys, keyCodeLabel } from './shortcutLabels';
 
 /** Global open-state for the keyboard shortcuts help dialog. */
 export const keyboardShortcutsDialogAtom = atom<boolean>(false);
@@ -101,9 +98,6 @@ export function KeyboardShortcutsDialog() {
   const { open, closeDialog } = useKeyboardShortcutsDialog();
   const modalStyle = useModalStyle(480);
   const [enterForNewline] = useSetting(settingsAtom, 'enterForNewline');
-  const [pttMode] = useSetting(settingsAtom, 'pttMode');
-  const [pttKey] = useSetting(settingsAtom, 'pttKey');
-  const [deafenKey] = useSetting(settingsAtom, 'deafenKey');
 
   const modKey = isMacOS() ? KeySymbol.Command : 'Ctrl';
 
@@ -115,8 +109,6 @@ export function KeyboardShortcutsDialog() {
       rows: [
         { description: 'Show keyboard shortcuts', keys: ['?'] },
         { description: 'Close open panel, otherwise mark room as read', keys: [KeySymbol.Escape] },
-        // [Gitea #334] the quick switcher / search was missing
-        { description: 'Quick switcher: jump to a room or person', keys: [modKey, 'K'] },
       ],
     },
     {
@@ -132,26 +124,6 @@ export function KeyboardShortcutsDialog() {
           keys: enterForNewline ? ['Enter'] : [KeySymbol.Shift, 'Enter'],
         },
         { description: 'Send message (always)', keys: [modKey, 'Enter'] },
-        { description: 'Edit your last message (empty composer)', keys: ['↑'] },
-      ],
-    },
-    {
-      // [Gitea #334] generated from the editor's own bindings so they can't drift
-      title: 'Composer formatting',
-      rows: [
-        ...Object.entries(INLINE_HOTKEYS).map(([hotkey, mark]) => ({
-          description:
-            mark === MarkType.StrikeThrough
-              ? `${MARK_LABELS[mark]} (not the browser's Save)`
-              : MARK_LABELS[mark],
-          keys: hotkeyKeys(hotkey, modKey),
-        })),
-        { description: 'Heading 1 / 2 / 3', keys: [modKey, '1 / 2 / 3'] },
-        ...Object.entries(BLOCK_HOTKEYS).map(([hotkey, block]) => ({
-          description: BLOCK_LABELS[block] ?? block,
-          keys: hotkeyKeys(hotkey, modKey),
-        })),
-        { description: 'Clear formatting', keys: [modKey, 'E'] },
       ],
     },
     {
@@ -160,19 +132,6 @@ export function KeyboardShortcutsDialog() {
         { description: 'Reveal message actions (react, reply, more)', keys: ['Hover / focus'] },
       ],
     },
-    {
-      // [Gitea #334] the user's own bindings (Settings → Calls)
-      title: 'Calls',
-      rows: [
-        {
-          description: pttMode
-            ? 'Push to talk (hold)'
-            : 'Push to talk (hold; turn on in Settings → Calls)',
-          keys: [keyCodeLabel(pttKey)],
-        },
-        { description: 'Deafen / undeafen', keys: [keyCodeLabel(deafenKey)] },
-      ],
-    },
   ];
 
   return (

src/app/features/shortcuts/shortcutLabels.test.ts

@@ -1,16 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { hotkeyKeys, keyCodeLabel } from './shortcutLabels';
-
-test('hotkeyKeys (#334)', () => {
-  assert.deepEqual(hotkeyKeys('mod+b', 'Ctrl'), ['Ctrl', 'B']);
-  assert.deepEqual(hotkeyKeys("mod+'", '⌘'), ['⌘', "'"]);
-  assert.deepEqual(hotkeyKeys('mod+[', 'Ctrl'), ['Ctrl', '[']);
-});
-
-test('keyCodeLabel (#334)', () => {
-  assert.equal(keyCodeLabel('KeyM'), 'M');
-  assert.equal(keyCodeLabel('Digit1'), '1');
-  assert.equal(keyCodeLabel('Space'), 'Space');
-  assert.equal(keyCodeLabel(''), 'Not set');
-});

src/app/features/shortcuts/shortcutLabels.ts

@@ -1,29 +0,0 @@
-import { BlockType, MarkType } from '../../components/editor/types';
-
-/** Pure: an is-hotkey string ('mod+b', "mod+'") as keycap labels. */
-export const hotkeyKeys = (hotkey: string, modKey: string): string[] =>
-  hotkey.split('+').map((k) => (k === 'mod' ? modKey : k.length === 1 ? k.toUpperCase() : k));
-
-/** Pure: a KeyboardEvent.code ('KeyM', 'Digit1', 'Space') as a keycap label. */
-export const keyCodeLabel = (code: string | undefined): string => {
-  if (!code) return 'Not set';
-  if (/^Key[A-Z]$/.test(code)) return code.slice(3);
-  if (/^Digit\d$/.test(code)) return code.slice(5);
-  return code;
-};
-
-export const MARK_LABELS: Record<MarkType, string> = {
-  [MarkType.Bold]: 'Bold',
-  [MarkType.Italic]: 'Italic',
-  [MarkType.Underline]: 'Underline',
-  [MarkType.StrikeThrough]: 'Strikethrough',
-  [MarkType.Code]: 'Inline code',
-  [MarkType.Spoiler]: 'Spoiler',
-};
-
-export const BLOCK_LABELS: Partial<Record<BlockType, string>> = {
-  [BlockType.OrderedList]: 'Numbered list',
-  [BlockType.UnorderedList]: 'Bulleted list',
-  [BlockType.BlockQuote]: 'Quote',
-  [BlockType.CodeBlock]: 'Code block',
-};

src/app/utils/linkSafety.test.ts

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { analyzeLink, hostFromText, registrableDomain } from './linkSafety';
+import { analyzeLink, hostFromText, previewUrlsFor, registrableDomain } from './linkSafety';
 
 test('visible text that names another site is a mismatch', () => {
   const r = analyzeLink('https://matrix.lotusguild.org/login', 'https://evil.example/login');
@@ -73,3 +73,25 @@ test('shared hosting suffixes are separate sites (#335)', () => {
   );
   assert.equal(registrableDomain('news.bbc.co.uk'), 'bbc.co.uk');
 });
+
+test('previewUrlsFor: no preview for a site a deceptive link only claims (#286)', () => {
+  const urls = ['https://paypal.com'];
+  assert.deepEqual(
+    previewUrlsFor(urls, '<a href="https://evil.example/login">https://paypal.com</a>'),
+    [],
+  );
+  // An honest link keeps its preview.
+  assert.deepEqual(
+    previewUrlsFor(urls, '<a href="https://www.paypal.com/x">https://paypal.com</a>'),
+    urls,
+  );
+  assert.deepEqual(previewUrlsFor(urls, undefined), urls);
+  // Other links in the message keep theirs.
+  assert.deepEqual(
+    previewUrlsFor(
+      ['https://paypal.com', 'https://lotusguild.org'],
+      'see <a href="https://evil.example">paypal.com</a> and https://lotusguild.org',
+    ),
+    ['https://lotusguild.org'],
+  );
+});

src/app/utils/linkSafety.ts

@@ -221,3 +221,37 @@ export const analyzeLink = (text: string, href: string): LinkSafety | null => {
   const other = shown.find((h) => registrableDomain(h) !== realSite);
   return { mismatch: other !== undefined, shownHost: other ?? shown[0], realHost, punycode };
 };
+
+const ANCHOR_REG = /<a\s[^>]*href\s*=\s*(["'])(.*?)\1[^>]*>([\s\S]*?)<\/a>/gi;
+const decodeEntities = (s: string): string =>
+  s
+    .replace(/<[^>]+>/g, '')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
+
+/**
+ * [Gitea #286] The URLs to build link previews for. Previews come from the
+ * plain `body`, but clicks follow `formatted_body`'s hrefs, and a sender
+ * controls both: text reading "https://paypal.com" linked to evil.example got
+ * a genuine PayPal card. Drop any body URL whose site is only *claimed* by a
+ * deceptive link's text.
+ */
+export const previewUrlsFor = (urls: string[], formattedBody: string | undefined): string[] => {
+  if (!formattedBody || urls.length === 0) return urls;
+  const claimed = new Set<string>();
+  Array.from(formattedBody.matchAll(ANCHOR_REG)).forEach((m) => {
+    const safety = analyzeLink(decodeEntities(m[3]), decodeEntities(m[2]));
+    if (safety?.mismatch && safety.shownHost) claimed.add(registrableDomain(safety.shownHost));
+  });
+  if (claimed.size === 0) return urls;
+  return urls.filter((u) => {
+    try {
+      return !claimed.has(registrableDomain(new URL(u).hostname));
+    } catch {
+      return true;
+    }
+  });
+};