mirror of
https://codeberg.org/yeentown/barkey.git
synced 2025-10-25 18:54:52 +00:00
d10fdfe973
* SP-2025-03.1 always wrap icon&thumbnail URLs if they're not HTTP URLs, the frontend won't be able to display them anyway (`<img src="mailto:…">` or '<div stile="background-image: url(nntp:…)">` aren't going to work!), so let's always run them through the media proxy, which will fail harder (fetching a `javascript:` URL won't do anything in the backend, might do something in the frontend) and will always protect the client's address in cases like `gemini:` where the browser could try to fetch * SP-2025-03.2 use object binding for more styles interpolating a random (remote-controlled!) string into a `style` attribute is a bad idea; using VueJS object binding, we should get proper quoting and therefore safe parse failures instead of CSS injections / XSS * SP-2025-03.3 slightly more robust "self" URL handling parse URLs instead of treating them as strings; this is still not perfect, but the `URL` class only handles full URLs, not relative ones, so there's so way to ask it "give me a URL object that represents this resource relative to this base URL" notice that passing very weird URLs to `MkUrl` and `MkUrlPreview` will break the frontend (in dev mode) because there's an untrapped `new URL(…)` that may explode; production builds seem to safely ignore the error, though --------- Co-authored-by: dakkar <dakkar@thenautilus.net>
61 lines
1.7 KiB
Vue
61 lines
1.7 KiB
Vue
<!--
|
|
SPDX-FileCopyrightText: syuilo and misskey-project
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
-->
|
|
|
|
<template>
|
|
<component
|
|
:is="self ? 'MkA' : 'a'" ref="el" style="word-break: break-all;" class="_link" :[attr]="maybeRelativeUrl" :rel="rel ?? 'nofollow noopener'" :target="target"
|
|
:behavior="props.navigationBehavior"
|
|
:title="url"
|
|
@click.prevent="self ? true : warningExternalWebsite(url)"
|
|
@click.stop
|
|
>
|
|
<slot></slot>
|
|
<i v-if="target === '_blank'" class="ti ti-external-link" :class="$style.icon"></i>
|
|
</component>
|
|
</template>
|
|
|
|
<script lang="ts" setup>
|
|
import { defineAsyncComponent, ref } from 'vue';
|
|
import { url as local } from '@@/js/config.js';
|
|
import { useTooltip } from '@/use/use-tooltip.js';
|
|
import * as os from '@/os.js';
|
|
import { isEnabledUrlPreview } from '@/instance.js';
|
|
import type { MkABehavior } from '@/components/global/MkA.vue';
|
|
import { warningExternalWebsite } from '@/utility/warning-external-website.js';
|
|
import { maybeMakeRelative } from '@@/js/url.js';
|
|
|
|
const props = withDefaults(defineProps<{
|
|
url: string;
|
|
rel?: null | string;
|
|
navigationBehavior?: MkABehavior;
|
|
}>(), {
|
|
});
|
|
|
|
const maybeRelativeUrl = maybeMakeRelative(props.url, local);
|
|
const self = maybeRelativeUrl !== props.url;
|
|
const attr = self ? 'to' : 'href';
|
|
const target = self ? null : '_blank';
|
|
|
|
const el = ref<HTMLElement | { $el: HTMLElement }>();
|
|
|
|
if (isEnabledUrlPreview.value) {
|
|
useTooltip(el, (showing) => {
|
|
const { dispose } = os.popup(defineAsyncComponent(() => import('@/components/MkUrlPreviewPopup.vue')), {
|
|
showing,
|
|
url: props.url,
|
|
source: el.value instanceof HTMLElement ? el.value : el.value?.$el,
|
|
}, {
|
|
closed: () => dispose(),
|
|
});
|
|
});
|
|
}
|
|
</script>
|
|
|
|
<style lang="scss" module>
|
|
.icon {
|
|
padding-left: 2px;
|
|
font-size: .9em;
|
|
}
|
|
</style>
|