From 695bbf02ca3ffe44e10bc2d8193af3504db8ac11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=81=82=E3=82=8F=E3=82=8F=E3=82=8F=E3=81=A8=E3=83=BC?= =?UTF-8?q?=E3=81=AB=E3=82=85?= <17376330+u1-liquid@users.noreply.github.com> Date: Thu, 1 May 2025 21:21:36 +0900 Subject: [PATCH 1/3] Merge commit from fork MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit d10fdfe9738b17a9d81037c031b40a2cc4cb8038) * SP-2025-03.1 always wrap icon&thumbnail URLs if they're not HTTP URLs, the frontend won't be able to display them anyway (`` or '
` aren't going to work!), so let's always run them through the media proxy, which will fail harder (fetching a `javascript:` URL won't do anything in the backend, might do something in the frontend) and will always protect the client's address in cases like `gemini:` where the browser could try to fetch * SP-2025-03.2 use object binding for more styles interpolating a random (remote-controlled!) string into a `style` attribute is a bad idea; using VueJS object binding, we should get proper quoting and therefore safe parse failures instead of CSS injections / XSS * SP-2025-03.3 slightly more robust "self" URL handling parse URLs instead of treating them as strings; this is still not perfect, but the `URL` class only handles full URLs, not relative ones, so there's so way to ask it "give me a URL object that represents this resource relative to this base URL" notice that passing very weird URLs to `MkUrl` and `MkUrlPreview` will break the frontend (in dev mode) because there's an untrapped `new URL(…)` that may explode; production builds seem to safely ignore the error, though --------- Co-authored-by: Julia Co-authored-by: dakkar --- .../backend/src/server/web/UrlPreviewService.ts | 1 - packages/frontend/src/components/MkLink.vue | 8 +++++--- .../frontend/src/components/MkUrlPreview.vue | 8 +++++--- packages/frontend/src/components/MkUserInfo.vue | 2 +- .../frontend/src/components/MkUserPopup.vue | 2 +- .../src/components/MkUserSetupDialog.User.vue | 2 +- .../frontend/src/components/global/MkUrl.vue | 8 +++++--- packages/frontend/src/scripts/url.ts | 17 +++++++++++++++++ packages/frontend/src/widgets/WidgetPhotos.vue | 2 +- .../src/widgets/server-metric/cpu-mem.vue | 4 ++-- 10 files changed, 38 insertions(+), 16 deletions(-) diff --git a/packages/backend/src/server/web/UrlPreviewService.ts b/packages/backend/src/server/web/UrlPreviewService.ts index 04b208909..36b3c4521 100644 --- a/packages/backend/src/server/web/UrlPreviewService.ts +++ b/packages/backend/src/server/web/UrlPreviewService.ts @@ -37,7 +37,6 @@ export class UrlPreviewService { @bindThis private wrap(url?: string | null): string | null { if (!url) return null; - if (!RegExp(/^https?:\/\//).exec(url)) return url; return appendQuery( `${this.config.mediaProxy}/preview/${encodeURIComponent(omitHttps(url))}`, diff --git a/packages/frontend/src/components/MkLink.vue b/packages/frontend/src/components/MkLink.vue index 36167e22e..32d2ae35e 100644 --- a/packages/frontend/src/components/MkLink.vue +++ b/packages/frontend/src/components/MkLink.vue @@ -9,7 +9,7 @@ SPDX-License-Identifier: AGPL-3.0-only ref="el" style="word-break: break-all;" class="_link" - :[attr]="self ? url.substring(local.length) : url" + :[attr]="maybeRelativeUrl" :rel="rel ?? 'nofollow noopener'" :target="target" :behavior="props.navigationBehavior" @@ -28,7 +28,8 @@ import { useTooltip } from '@/scripts/use-tooltip.js'; import { warningExternalWebsite } from '@/scripts/warning-external-website.js'; import * as os from '@/os.js'; import { isEnabledUrlPreview } from '@/instance.js'; -import { MkABehavior } from '@/components/global/MkA.vue'; +import type { MkABehavior } from '@/components/global/MkA.vue'; +import { maybeMakeRelative } from '@/scripts/url.js'; const props = withDefaults(defineProps<{ url: string; @@ -39,7 +40,8 @@ const props = withDefaults(defineProps<{ hideIcon: false, }); -const self = props.url.startsWith(local); +const maybeRelativeUrl = maybeMakeRelative(props.url, local); +const self = maybeRelativeUrl !== props.url; const attr = self ? 'to' : 'href'; const target = self ? null : '_blank'; diff --git a/packages/frontend/src/components/MkUrlPreview.vue b/packages/frontend/src/components/MkUrlPreview.vue index c198966bf..b99a4d02e 100644 --- a/packages/frontend/src/components/MkUrlPreview.vue +++ b/packages/frontend/src/components/MkUrlPreview.vue @@ -47,13 +47,13 @@ SPDX-License-Identifier: AGPL-3.0-only -
+
@@ -101,6 +101,7 @@ import MkButton from '@/components/MkButton.vue'; import { versatileLang } from '@/scripts/intl-const.js'; import { defaultStore } from '@/store.js'; import { warningExternalWebsite } from '@/scripts/warning-external-website.js'; +import { maybeMakeRelative } from '@/scripts/url.js'; type SummalyResult = Awaited>; @@ -118,7 +119,8 @@ const props = withDefaults(defineProps<{ const MOBILE_THRESHOLD = 500; const isMobile = ref(deviceKind === 'smartphone' || window.innerWidth <= MOBILE_THRESHOLD); -const self = props.url.startsWith(local); +const maybeRelativeUrl = maybeMakeRelative(props.url, local); +const self = maybeRelativeUrl !== props.url; const attr = self ? 'to' : 'href'; const target = self ? null : '_blank'; const fetching = ref(true); diff --git a/packages/frontend/src/components/MkUserInfo.vue b/packages/frontend/src/components/MkUserInfo.vue index f247ba8fd..ead2b6429 100644 --- a/packages/frontend/src/components/MkUserInfo.vue +++ b/packages/frontend/src/components/MkUserInfo.vue @@ -5,7 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only