mirror of
https://activitypub.software/TransFem-org/Sharkey.git
synced 2025-08-21 05:44:48 +00:00
d10fdfe973
* SP-2025-03.1 always wrap icon&thumbnail URLs if they're not HTTP URLs, the frontend won't be able to display them anyway (`<img src="mailto:…">` or '<div stile="background-image: url(nntp:…)">` aren't going to work!), so let's always run them through the media proxy, which will fail harder (fetching a `javascript:` URL won't do anything in the backend, might do something in the frontend) and will always protect the client's address in cases like `gemini:` where the browser could try to fetch * SP-2025-03.2 use object binding for more styles interpolating a random (remote-controlled!) string into a `style` attribute is a bad idea; using VueJS object binding, we should get proper quoting and therefore safe parse failures instead of CSS injections / XSS * SP-2025-03.3 slightly more robust "self" URL handling parse URLs instead of treating them as strings; this is still not perfect, but the `URL` class only handles full URLs, not relative ones, so there's so way to ask it "give me a URL object that represents this resource relative to this base URL" notice that passing very weird URLs to `MkUrl` and `MkUrlPreview` will break the frontend (in dev mode) because there's an untrapped `new URL(…)` that may explode; production builds seem to safely ignore the error, though --------- Co-authored-by: dakkar <dakkar@thenautilus.net>
45 lines
1.6 KiB
TypeScript
45 lines
1.6 KiB
TypeScript
/*
|
||
* SPDX-FileCopyrightText: syuilo and misskey-project
|
||
* SPDX-License-Identifier: AGPL-3.0-only
|
||
*/
|
||
|
||
/* objを検査して
|
||
* 1. 配列に何も入っていない時はクエリを付けない
|
||
* 2. プロパティがundefinedの時はクエリを付けない
|
||
* （new URLSearchParams(obj)ではそこまで丁寧なことをしてくれない）
|
||
*/
|
||
export function query(obj: Record<string, string | number | boolean>): string {
|
||
const params = Object.entries(obj)
|
||
.filter(([, v]) => Array.isArray(v) ? v.length : v !== undefined) // eslint-disable-line @typescript-eslint/no-unnecessary-condition
|
||
.reduce<Record<string, string | number | boolean>>((a, [k, v]) => (a[k] = v, a), {});
|
||
|
||
return Object.entries(params)
|
||
.map((p) => `${p[0]}=${encodeURIComponent(p[1])}`)
|
||
.join('&');
|
||
}
|
||
|
||
export function appendQuery(url: string, queryString: string): string {
|
||
return `${url}${/\?/.test(url) ? url.endsWith('?') ? '' : '&' : '?'}${queryString}`;
|
||
}
|
||
|
||
export function extractDomain(url: string) {
|
||
const match = url.match(/^(?:https?:)?(?:\/\/)?(?:[^@\n]+@)?([^:\/\n]+)/im);
|
||
return match ? match[1] : null;
|
||
}
|
||
|
||
export function maybeMakeRelative(urlStr: string, baseStr: string): string {
|
||
try {
|
||
const baseObj = new URL(baseStr);
|
||
const urlObj = new URL(urlStr);
|
||
/* in all places where maybeMakeRelative is used, baseStr is the
|
||
* instance's public URL, which can't have path components, so the
|
||
* relative URL will always have the whole path from the urlStr
|
||
*/
|
||
if (urlObj.origin === baseObj.origin) {
|
||
return urlObj.pathname + urlObj.search + urlObj.hash;
|
||
}
|
||
return urlStr;
|
||
} catch (e) {
|
||
return '';
|
||
}
|
||
}
|