resolveEmbed fell back to the preview's og:url for any posted link. og:url comes from the linked page itself, so https://evil.example/free-gift could serve og:url = youtube.com/watch?v=…. It then rendered as a playable YouTube card of a video the attacker chose, with labels linking to evil.example.
Change: new sameProvider(url, ogUrl). The og:url fallback is used only when it's on the posted link's own provider: the same last two domain labels, with the provider's short-link domains folded in (youtu.be, youtube-nocookie.com → youtube.com; spotify.link → spotify.com; redd.it → reddit.com; x.com → twitter.com; …). vm.tiktok.com and on.soundcloud.com match on their base domain.
Verified in Chromium, with preview_url routed to a hostile page's metadata (og:url YouTube, og:site_name YouTube):
https://evil.example/free-gift, before: a YouTube card with a Play button. After: no embed and no Play.
https://youtu.be/… with the same og:url: still embeds, with Play.
Unit tests cover evil.example, a youtube.com.evil.example look-alike, youtu.be, m.youtube.com, vm.tiktok.com, spotify.link, on.soundcloud.com, redd.it, and garbage input.
Note: the plain card still shows whatever og:site_name / og:title the page claims, which is how every link preview works. Showing the real destination host on plain cards would be a separate change, alongside #286.
Fixes #326.
`resolveEmbed` fell back to the preview's `og:url` for any posted link. `og:url` comes from the linked page itself, so `https://evil.example/free-gift` could serve `og:url = youtube.com/watch?v=…`. It then rendered as a **playable YouTube card** of a video the attacker chose, with labels linking to evil.example.
**Change:** new `sameProvider(url, ogUrl)`. The `og:url` fallback is used only when it's on the posted link's own provider: the same last two domain labels, with the provider's short-link domains folded in (`youtu.be`, `youtube-nocookie.com` → youtube.com; `spotify.link` → spotify.com; `redd.it` → reddit.com; `x.com` → twitter.com; …). `vm.tiktok.com` and `on.soundcloud.com` match on their base domain.
**Verified** in Chromium, with `preview_url` routed to a hostile page's metadata (`og:url` YouTube, `og:site_name` YouTube):
- `https://evil.example/free-gift`, **before:** a YouTube card with a **Play** button. **After:** no embed and no Play.
- `https://youtu.be/…` with the same `og:url`: still embeds, with Play.
Unit tests cover evil.example, a `youtube.com.evil.example` look-alike, youtu.be, m.youtube.com, vm.tiktok.com, spotify.link, on.soundcloud.com, redd.it, and garbage input.
Note: the plain card still shows whatever `og:site_name` / `og:title` the page claims, which is how every link preview works. Showing the real destination host on plain cards would be a separate change, alongside #286.
`tsc` clean · ESLint clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
The embed fallback used the preview's og:url whatever site was posted.
og:url is set by the page, so evil.example could render as a playable
YouTube card (attacker's video) whose links go to evil.example. Only use
an og:url on the same provider as the posted link, including the
provider's own short-link domains (youtu.be, spotify.link, redd.it, …).
Fixes#326
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared
merged commit 099ada5d18 into lotus2026-10-18 05:54:22 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #326.
resolveEmbedfell back to the preview'sog:urlfor any posted link.og:urlcomes from the linked page itself, sohttps://evil.example/free-giftcould serveog:url = youtube.com/watch?v=…. It then rendered as a playable YouTube card of a video the attacker chose, with labels linking to evil.example.Change: new
sameProvider(url, ogUrl). Theog:urlfallback is used only when it's on the posted link's own provider: the same last two domain labels, with the provider's short-link domains folded in (youtu.be,youtube-nocookie.com→ youtube.com;spotify.link→ spotify.com;redd.it→ reddit.com;x.com→ twitter.com; …).vm.tiktok.comandon.soundcloud.commatch on their base domain.Verified in Chromium, with
preview_urlrouted to a hostile page's metadata (og:urlYouTube,og:site_nameYouTube):https://evil.example/free-gift, before: a YouTube card with a Play button. After: no embed and no Play.https://youtu.be/…with the sameog:url: still embeds, with Play.Unit tests cover evil.example, a
youtube.com.evil.examplelook-alike, youtu.be, m.youtube.com, vm.tiktok.com, spotify.link, on.soundcloud.com, redd.it, and garbage input.Note: the plain card still shows whatever
og:site_name/og:titlethe page claims, which is how every link preview works. Showing the real destination host on plain cards would be a separate change, alongside #286.tscclean · ESLint clean.🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5