mirror of
https://codeberg.org/yeentown/barkey.git
synced 2025-10-24 02:04:51 +00:00
d10fdfe973
* SP-2025-03.1 always wrap icon&thumbnail URLs if they're not HTTP URLs, the frontend won't be able to display them anyway (`<img src="mailto:…">` or '<div stile="background-image: url(nntp:…)">` aren't going to work!), so let's always run them through the media proxy, which will fail harder (fetching a `javascript:` URL won't do anything in the backend, might do something in the frontend) and will always protect the client's address in cases like `gemini:` where the browser could try to fetch * SP-2025-03.2 use object binding for more styles interpolating a random (remote-controlled!) string into a `style` attribute is a bad idea; using VueJS object binding, we should get proper quoting and therefore safe parse failures instead of CSS injections / XSS * SP-2025-03.3 slightly more robust "self" URL handling parse URLs instead of treating them as strings; this is still not perfect, but the `URL` class only handles full URLs, not relative ones, so there's so way to ask it "give me a URL object that represents this resource relative to this base URL" notice that passing very weird URLs to `MkUrl` and `MkUrlPreview` will break the frontend (in dev mode) because there's an untrapped `new URL(…)` that may explode; production builds seem to safely ignore the error, though --------- Co-authored-by: dakkar <dakkar@thenautilus.net> |
||
|---|---|---|
| .. | ||
| @types | ||
| boot | ||
| core | ||
| daemons | ||
| misc | ||
| models | ||
| queue | ||
| server | ||
| config.ts | ||
| const.ts | ||
| decorators.ts | ||
| di-symbols.ts | ||
| env.ts | ||
| global.d.ts | ||
| GlobalModule.ts | ||
| logger.ts | ||
| MainModule.ts | ||
| NestLogger.ts | ||
| postgres.ts | ||
| types.ts | ||