Lotus CIandClaude Opus 5.5
2c11bd3b8e
CI / Build & Quality Checks (pull_request) Successful in 4m30s
CI / Trigger Desktop Build (pull_request) Skipped
CI / Docker image build & smoke test (pull_request) Skipped
CI / Secret scan (gitleaks) (pull_request) Successful in 15s
CI / Playwright smoke (e2e) (pull_request) Successful in 17m17s
The embed fallback used the preview's og:url whatever site was posted. og:url is set by the page, so evil.example could render as a playable YouTube card (attacker's video) whose links go to evil.example. Only use an og:url on the same provider as the posted link, including the provider's own short-link domains (youtu.be, spotify.link, redd.it, …). Fixes #326 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
37 lines
1.3 KiB
TypeScript
37 lines
1.3 KiB
TypeScript
/**
|
|
* [Gitea #326] A page's og:url is chosen by the page itself, so a phishing
|
|
* link could serve `og:url = youtube.com/watch?v=…` and render as a playable
|
|
* YouTube card linking to the attacker. Only trust an og:url on the same
|
|
* provider as the link actually posted (including the provider's own
|
|
* short-link domains).
|
|
*/
|
|
const PROVIDER_ALIASES: Record<string, string> = {
|
|
'youtu.be': 'youtube.com',
|
|
'youtube-nocookie.com': 'youtube.com',
|
|
'spotify.link': 'spotify.com',
|
|
'redd.it': 'reddit.com',
|
|
'x.com': 'twitter.com',
|
|
'twitch.tv': 'twitch.tv',
|
|
'apple.co': 'apple.com',
|
|
};
|
|
|
|
/**
|
|
* Pure: the provider a host belongs to (last two labels, aliases folded). Hosts
|
|
* under two-part public suffixes (`*.co.uk`) share a value, which is harmless
|
|
* here: no embeddable provider lives under one.
|
|
*/
|
|
export const providerOf = (host: string): string => {
|
|
const parts = host.toLowerCase().replace(/\.$/, '').split('.');
|
|
const base = parts.slice(-2).join('.');
|
|
return PROVIDER_ALIASES[base] ?? base;
|
|
};
|
|
|
|
/** Pure: whether `ogUrl` is on the same provider as the posted `url`. */
|
|
export function sameProvider(url: string, ogUrl: string): boolean {
|
|
try {
|
|
return providerOf(new URL(url).hostname) === providerOf(new URL(ogUrl).hostname);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|