Lotus CIandClaude Opus 5.5
2c11bd3b8e
CI / Build & Quality Checks (pull_request) Successful in 4m30s
CI / Trigger Desktop Build (pull_request) Skipped
CI / Docker image build & smoke test (pull_request) Skipped
CI / Secret scan (gitleaks) (pull_request) Successful in 15s
CI / Playwright smoke (e2e) (pull_request) Successful in 17m17s
The embed fallback used the preview's og:url whatever site was posted. og:url is set by the page, so evil.example could render as a playable YouTube card (attacker's video) whose links go to evil.example. Only use an og:url on the same provider as the posted link, including the provider's own short-link domains (youtu.be, spotify.link, redd.it, …). Fixes #326 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
23 lines
1.0 KiB
TypeScript
23 lines
1.0 KiB
TypeScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { sameProvider } from './embedProvider';
|
|
|
|
test("sameProvider: a page cannot borrow another provider's embed via og:url (#326)", () => {
|
|
const yt = 'https://www.youtube.com/watch?v=dQw4w9WgXcQ';
|
|
assert.equal(sameProvider('https://evil.example/free-gift', yt), false);
|
|
assert.equal(sameProvider('https://youtube.com.evil.example/x', yt), false);
|
|
assert.equal(sameProvider('https://youtu.be/abc', yt), true);
|
|
assert.equal(sameProvider('https://m.youtube.com/shorts/abc', yt), true);
|
|
assert.equal(
|
|
sameProvider('https://vm.tiktok.com/ZM123/', 'https://www.tiktok.com/@a/video/1'),
|
|
true,
|
|
);
|
|
assert.equal(sameProvider('https://spotify.link/abc', 'https://open.spotify.com/track/1'), true);
|
|
assert.equal(sameProvider('https://on.soundcloud.com/x', 'https://soundcloud.com/a/b'), true);
|
|
assert.equal(
|
|
sameProvider('https://redd.it/abc', 'https://www.reddit.com/r/x/comments/abc/'),
|
|
true,
|
|
);
|
|
assert.equal(sameProvider('not a url', yt), false);
|
|
});
|