No OneTemporary
Actions

Authored By

Unknown

Size

23 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/scrubber-hidden-schemes.security b/changelog.d/scrubber-hidden-schemes.security
	new file mode 100644
	index 000000000..fc1807e72
	--- /dev/null
	+++ b/changelog.d/scrubber-hidden-schemes.security
	@@ -0,0 +1 @@
	+Scrubbers: remove links and images whose scheme is hidden with tabs, newlines or leading control characters (for example java<TAB>script:), which browsers still run as javascript:. Custom scrubbers should use Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes instead of the FastSanitize macro
	\ No newline at end of file
	diff --git a/lib/pleroma/html/uri_attributes.ex b/lib/pleroma/html/uri_attributes.ex
	new file mode 100644
	index 000000000..491f43e3d
	--- /dev/null
	+++ b/lib/pleroma/html/uri_attributes.ex
	@@ -0,0 +1,40 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.HTML.URIAttributes do
	+ @moduledoc """
	+ URI attribute rules for the scrubbers.
	+
	+ Works like `FastSanitize.Sanitizer.Meta.allow_tag_with_uri_attributes/3`, but
	+ checks the scheme the way a browser reads the URL. Browsers remove tabs and
	+ newlines anywhere and control characters and spaces at the start, so
	+ `java\\tscript:` is a `javascript:` link to them, while `URI.parse/1` finds no
	+ scheme and FastSanitize lets it through.
	+ """
	+
	+ defmacro allow_tag_with_uri_attributes(tag, attrs, valid_schemes) do
	+ for attr <- attrs do
	+ quote do
	+ def scrub_attribute(unquote(tag), {unquote(attr), "&" <> _}), do: nil
	+
	+ def scrub_attribute(unquote(tag), {unquote(attr), uri} = attribute) do
	+ if Pleroma.HTML.URIAttributes.valid_scheme?(uri, unquote(valid_schemes)),
	+ do: attribute
	+ end
	+ end
	+ end
	+ end
	+
	+ @spec valid_scheme?(String.t(), [String.t()]) :: boolean()
	+ def valid_scheme?(uri, valid_schemes) do
	+ scheme =
	+ uri
	+ \|> String.replace(~r/[\t\n\r]/, "")
	+ \|> String.replace(~r/\A[\x00-\x20]+/, "")
	+ \|> URI.parse()
	+ \|> Map.get(:scheme)
	+
	+ is_nil(scheme) or scheme in valid_schemes
	+ end
	+end
	diff --git a/priv/scrubbers/default.ex b/priv/scrubbers/default.ex
	index 8e2d16650..b294ce4ee 100644
	--- a/priv/scrubbers/default.ex
	+++ b/priv/scrubbers/default.ex
	@@ -1,181 +1,186 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTML.Scrubber.Default do
	@doc "The default HTML scrubbing policy: no "

	require FastSanitize.Sanitizer.Meta
	+ require Pleroma.HTML.URIAttributes
	alias FastSanitize.Sanitizer.Meta

	# credo:disable-for-previous-line
	# No idea how to fix this one…

	@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])

	Meta.strip_comments()

	- Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)
	+ Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(
	+ :a,
	+ ["href", "data-user", "data-tag"],
	+ @valid_schemes
	+ )

	Meta.allow_tag_with_this_attribute_values(:a, "class", [
	"hashtag",
	"u-url",
	"mention",
	"u-url mention",
	"mention u-url",
	"mention hashtag"
	])

	Meta.allow_tag_with_this_attribute_values(:a, "rel", [
	"tag",
	"nofollow",
	"noopener",
	"noreferrer",
	"ugc"
	])

	Meta.allow_tag_with_these_attributes(:a, ["name", "title", "lang"])

	Meta.allow_tag_with_these_attributes(:abbr, ["title", "lang"])
	Meta.allow_tag_with_these_attributes(:acronym, ["title", "lang"])

	# sort(1)-ed list
	Meta.allow_tag_with_these_attributes(:bdi, [])
	Meta.allow_tag_with_these_attributes(:bdo, ["dir"])
	Meta.allow_tag_with_these_attributes(:big, ["lang"])
	Meta.allow_tag_with_these_attributes(:b, ["lang"])
	Meta.allow_tag_with_these_attributes(:blockquote, ["lang"])
	Meta.allow_tag_with_these_attributes(:br, ["lang"])
	Meta.allow_tag_with_these_attributes(:center, [])
	Meta.allow_tag_with_these_attributes(:cite, ["lang"])
	Meta.allow_tag_with_these_attributes(:code, ["lang"])
	Meta.allow_tag_with_these_attributes(:del, ["lang"])
	Meta.allow_tag_with_these_attributes(:dfn, ["lang"])
	Meta.allow_tag_with_these_attributes(:em, ["lang"])
	Meta.allow_tag_with_these_attributes(:hr, ["lang"])
	Meta.allow_tag_with_these_attributes(:i, ["lang"])
	Meta.allow_tag_with_these_attributes(:ins, ["lang"])
	Meta.allow_tag_with_these_attributes(:kbd, ["lang"])
	Meta.allow_tag_with_these_attributes(:li, ["lang"])
	Meta.allow_tag_with_these_attributes(:ol, ["lang"])
	Meta.allow_tag_with_these_attributes(:p, ["lang"])
	Meta.allow_tag_with_these_attributes(:pre, ["lang"])
	Meta.allow_tag_with_these_attributes(:q, ["lang"])
	Meta.allow_tag_with_these_attributes(:rb, ["lang"])
	Meta.allow_tag_with_these_attributes(:rp, ["lang"])
	Meta.allow_tag_with_these_attributes(:rtc, ["lang"])
	Meta.allow_tag_with_these_attributes(:rt, ["lang"])
	Meta.allow_tag_with_these_attributes(:ruby, ["lang"])
	Meta.allow_tag_with_these_attributes(:samp, ["lang"])
	Meta.allow_tag_with_these_attributes(:s, ["lang"])
	Meta.allow_tag_with_these_attributes(:small, ["lang"])
	Meta.allow_tag_with_these_attributes(:strong, ["lang"])
	Meta.allow_tag_with_these_attributes(:sub, ["lang"])
	Meta.allow_tag_with_these_attributes(:sup, ["lang"])
	Meta.allow_tag_with_these_attributes(:tt, ["lang"])
	Meta.allow_tag_with_these_attributes(:u, ["lang"])
	Meta.allow_tag_with_these_attributes(:ul, ["lang"])
	Meta.allow_tag_with_these_attributes(:var, ["lang"])
	Meta.allow_tag_with_these_attributes(:wbr, ["lang"])

	Meta.allow_tag_with_this_attribute_values(:span, "class", [
	"h-card",
	"recipients-inline",
	"quote-inline",
	"invisible",
	"ellipsis",
	"mfm-tada",
	"mfm-jelly",
	"mfm-twitch",
	"mfm-shake",
	"mfm-spin",
	"mfm-jump",
	"mfm-bounce",
	"mfm-flip",
	"mfm-x2",
	"mfm-x3",
	"mfm-x4",
	"mfm-scale",
	"mfm-position",
	"mfm-fg",
	"mfm-bg",
	"mfm-border",
	"mfm-font",
	"mfm-blur",
	"mfm-rainbow",
	"mfm-sparkle",
	"mfm-rotate",
	"mfm-ruby",
	"mfm-unixtime",
	# Exists in Akkoma but not Misskey?
	"mfm-center"
	])

	Meta.allow_tag_with_this_attribute_values(:p, "class", ["quote-inline"])

	Meta.allow_tag_with_these_attributes(:span, [
	"lang",
	"data-mfm-speed",
	"data-mfm-delay",
	"data-mfm-left",
	"data-mfm-alternate",
	"data-mfm-x",
	"data-mfm-y",
	"data-mfm-h",
	"data-mfm-v",
	"data-mfm-color",
	"data-mfm-width",
	"data-mfm-style",
	"data-mfm-radius",
	"data-mfm-noclip",
	"data-mfm-serif",
	"data-mfm-monospace",
	"data-mfm-cursive",
	"data-mfm-fantasy",
	"data-mfm-emoji",
	"data-mfm-math",
	"data-mfm-deg"
	])

	Meta.allow_tag_with_this_attribute_values(:code, "class", ["inline"])

	@allow_inline_images Pleroma.Config.get([:markup, :allow_inline_images])

	if @allow_inline_images do
	Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])

	# restrict img tags to http/https only, because of MediaProxy.
	- Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
	+ Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])

	Meta.allow_tag_with_these_attributes(:img, [
	"width",
	"height",
	"title",
	"alt",
	"lang"
	])
	end

	if Pleroma.Config.get([:markup, :allow_tables]) do
	Meta.allow_tag_with_these_attributes(:table, ["lang"])
	Meta.allow_tag_with_these_attributes(:tbody, ["lang"])
	Meta.allow_tag_with_these_attributes(:td, ["lang"])
	Meta.allow_tag_with_these_attributes(:th, ["lang"])
	Meta.allow_tag_with_these_attributes(:thead, ["lang"])
	Meta.allow_tag_with_these_attributes(:tr, ["lang"])
	end

	if Pleroma.Config.get([:markup, :allow_headings]) do
	Meta.allow_tag_with_these_attributes(:h1, ["lang"])
	Meta.allow_tag_with_these_attributes(:h2, ["lang"])
	Meta.allow_tag_with_these_attributes(:h3, ["lang"])
	Meta.allow_tag_with_these_attributes(:h4, ["lang"])
	Meta.allow_tag_with_these_attributes(:h5, ["lang"])
	end

	if Pleroma.Config.get([:markup, :allow_fonts]) do
	Meta.allow_tag_with_these_attributes(:font, ["face", "lang"])
	end

	Meta.strip_everything_not_covered()
	end
	diff --git a/priv/scrubbers/links_only.ex b/priv/scrubbers/links_only.ex
	index 7f434fb25..42050d05a 100644
	--- a/priv/scrubbers/links_only.ex
	+++ b/priv/scrubbers/links_only.ex
	@@ -1,31 +1,32 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTML.Scrubber.LinksOnly do
	@moduledoc """
	An HTML scrubbing policy which limits to links only.
	"""

	@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])

	require FastSanitize.Sanitizer.Meta
	+ require Pleroma.HTML.URIAttributes
	alias FastSanitize.Sanitizer.Meta

	Meta.strip_comments()

	# links
	- Meta.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)
	+ Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:a, ["href"], @valid_schemes)

	Meta.allow_tag_with_this_attribute_values(:a, "rel", [
	"tag",
	"nofollow",
	"noopener",
	"noreferrer",
	"me",
	"ugc"
	])

	Meta.allow_tag_with_these_attributes(:a, ["name", "title"])
	Meta.strip_everything_not_covered()
	end
	diff --git a/priv/scrubbers/twitter_text.ex b/priv/scrubbers/twitter_text.ex
	index 4df840735..266411e72 100644
	--- a/priv/scrubbers/twitter_text.ex
	+++ b/priv/scrubbers/twitter_text.ex
	@@ -1,63 +1,68 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTML.Scrubber.TwitterText do
	@moduledoc """
	An HTML scrubbing policy which limits to twitter-style text. Only
	paragraphs, breaks and links are allowed through the filter.
	"""

	@valid_schemes Pleroma.Config.get([:uri_schemes, :valid_schemes], [])

	require FastSanitize.Sanitizer.Meta
	+ require Pleroma.HTML.URIAttributes
	alias FastSanitize.Sanitizer.Meta

	Meta.strip_comments()

	# links
	- Meta.allow_tag_with_uri_attributes(:a, ["href", "data-user", "data-tag"], @valid_schemes)
	+ Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(
	+ :a,
	+ ["href", "data-user", "data-tag"],
	+ @valid_schemes
	+ )

	Meta.allow_tag_with_this_attribute_values(:a, "class", [
	"hashtag",
	"u-url",
	"mention",
	"u-url mention",
	"mention u-url",
	"mention hashtag"
	])

	Meta.allow_tag_with_this_attribute_values(:a, "rel", [
	"tag",
	"nofollow",
	"noopener",
	"noreferrer"
	])

	Meta.allow_tag_with_these_attributes(:a, ["name", "title"])

	# paragraphs and linebreaks
	Meta.allow_tag_with_these_attributes(:br, [])
	Meta.allow_tag_with_these_attributes(:p, [])

	# microformats
	Meta.allow_tag_with_this_attribute_values(:span, "class", ["h-card"])
	Meta.allow_tag_with_these_attributes(:span, [])

	# allow inline images for custom emoji
	if Pleroma.Config.get([:markup, :allow_inline_images]) do
	Meta.allow_tag_with_this_attribute_values(:img, "class", ["emoji"])

	# restrict img tags to http/https only, because of MediaProxy.
	- Meta.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])
	+ Pleroma.HTML.URIAttributes.allow_tag_with_uri_attributes(:img, ["src"], ["http", "https"])

	Meta.allow_tag_with_these_attributes(:img, [
	"width",
	"height",
	"title",
	"alt"
	])
	end

	Meta.strip_everything_not_covered()
	end
	diff --git a/test/pleroma/html_test.exs b/test/pleroma/html_test.exs
	index d17b07540..9266f62ed 100644
	--- a/test/pleroma/html_test.exs
	+++ b/test/pleroma/html_test.exs
	@@ -1,303 +1,341 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTMLTest do
	alias Pleroma.HTML
	alias Pleroma.Object
	alias Pleroma.Web.CommonAPI
	use Pleroma.DataCase, async: true

	import Pleroma.Factory

	@html_sample """
	<b>this is in bold</b>
	<p>this is a paragraph</p>
	this is a linebreak<br />
	this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
	this is a link with not allowed "rel" attribute: <a href="http://example.com/" rel="tag noallowed">example.com</a>
	this is an image: <img src="http://example.com/image.jpg"><br />
	this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"><br />
	<script>alert('hacked')</script>
	"""

	@html_onerror_sample """
	<img src="http://example.com/image.jpg" onerror="alert('hacked')">
	"""

	@html_stillimage_sample """
	<img class="still-image" src="http://example.com/image.jpg">
	"""

	@html_span_class_sample """
	<span class="animate-spin">hi</span>
	"""

	@html_span_microformats_sample """
	<span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
	"""

	@html_span_invalid_microformats_sample """
	<span class="h-card"><a class="u-url mention animate-spin">@<span>foo</span></a></span>
	"""

	@mention_hashtags_sample """
	<a href="https://mastodon.example/tags/linux" class="mention hashtag" rel="tag">#<span>linux</span></a>
	"""

	describe "StripTags scrubber" do
	test "works as expected" do
	expected = """
	this is in bold
	this is a paragraph
	this is a linebreak
	this is a link with allowed "rel" attribute: example.com
	this is a link with not allowed "rel" attribute: example.com
	this is an image:
	this is an inline emoji:
	alert('hacked')
	"""

	assert expected == HTML.strip_tags(@html_sample)
	end

	test "does not allow attribute-based XSS" do
	expected = "\n"

	assert expected == HTML.strip_tags(@html_onerror_sample)
	end
	end

	describe "TwitterText scrubber" do
	test "normalizes HTML as expected" do
	expected = """
	this is in bold
	<p>this is a paragraph</p>
	this is a linebreak<br/>
	this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
	this is a link with not allowed "rel" attribute: <a href="http://example.com/">example.com</a>
	this is an image: <img src="http://example.com/image.jpg"/><br/>
	this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"/><br/>
	alert('hacked')
	"""

	assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does not allow attribute-based XSS" do
	expected = """
	<img src="http://example.com/image.jpg"/>
	"""

	assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does not allow spans with invalid classes" do
	expected = """
	<span>hi</span>
	"""

	assert expected ==
	HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does not allow images with invalid classes" do
	expected = """
	<img src="http://example.com/image.jpg"/>
	"""

	assert expected ==
	HTML.filter_tags(@html_stillimage_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does allow microformats" do
	expected = """
	<span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "filters invalid microformats markup" do
	expected = """
	<span class="h-card"><a>@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(
	@html_span_invalid_microformats_sample,
	Pleroma.HTML.Scrubber.TwitterText
	)
	end

	test "does allow mention hashtags" do
	expected = """
	<a href="https://mastodon.example/tags/linux" class="mention hashtag" rel="tag">#<span>linux</span></a>
	"""

	assert expected ==
	HTML.filter_tags(@mention_hashtags_sample, Pleroma.HTML.Scrubber.Default)
	end
	end

	+ describe "link schemes as a browser sees them" do
	+ # Browsers remove tabs and newlines in URLs and control characters and
	+ # spaces at the start, so these are javascript: links to them.
	+ test "removes javascript: links hidden with control characters" do
	+ for href <- [
	+ "java\tscript:alert(1)",
	+ "java script:alert(1)",
	+ "java\nscript:alert(1)",
	+ " javascript:alert(1)",
	+ " javascript:alert(1)",
	+ "\u0001javascript:alert(1)"
	+ ],
	+ scrubber <- [
	+ Pleroma.HTML.Scrubber.Default,
	+ Pleroma.HTML.Scrubber.TwitterText,
	+ Pleroma.HTML.Scrubber.LinksOnly
	+ ] do
	+ html = HTML.filter_tags(~s(<a href="#{href}">x</a>), scrubber)
	+
	+ refute html =~ "href", "#{inspect(href)} survived #{inspect(scrubber)}: #{html}"
	+ end
	+ end
	+
	+ test "keeps normal links" do
	+ for href <- ["https://example.org/a?b=c", "/relative/path", "#fragment"] do
	+ assert HTML.filter_tags(~s(<a href="#{href}">x</a>), Pleroma.HTML.Scrubber.Default) ==
	+ ~s(<a href="#{href}">x</a>)
	+ end
	+ end
	+
	+ test "removes images with hidden schemes" do
	+ html =
	+ HTML.filter_tags(~s\|<img src="java\tscript:alert(1)"/>\|, Pleroma.HTML.Scrubber.Default)
	+
	+ refute html =~ "src"
	+ end
	+ end
	+
	describe "default scrubber" do
	test "normalizes HTML as expected" do
	expected = """
	<b>this is in bold</b>
	<p>this is a paragraph</p>
	this is a linebreak<br/>
	this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
	this is a link with not allowed "rel" attribute: <a href="http://example.com/">example.com</a>
	this is an image: <img src="http://example.com/image.jpg"/><br/>
	this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"/><br/>
	alert('hacked')
	"""

	assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "does not allow attribute-based XSS" do
	expected = """
	<img src="http://example.com/image.jpg"/>
	"""

	assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "does not allow spans with invalid classes" do
	expected = """
	<span>hi</span>
	"""

	assert expected == HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "does not allow images with invalid classes" do
	expected = """
	<img src="http://example.com/image.jpg"/>
	"""

	assert expected ==
	HTML.filter_tags(@html_stillimage_sample, Pleroma.HTML.Scrubber.TwitterText)
	end

	test "does allow microformats" do
	expected = """
	<span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.Default)
	end

	test "filters invalid microformats markup" do
	expected = """
	<span class="h-card"><a>@<span>foo</span></a></span>
	"""

	assert expected ==
	HTML.filter_tags(
	@html_span_invalid_microformats_sample,
	Pleroma.HTML.Scrubber.Default
	)
	end

	test "does allow mention hashtags" do
	expected = """
	<a href="https://mastodon.example/tags/linux" class="mention hashtag" rel="tag">#<span>linux</span></a>
	"""

	assert expected ==
	HTML.filter_tags(@mention_hashtags_sample, Pleroma.HTML.Scrubber.Default)
	end
	end

	describe "extract_first_external_url_from_object" do
	test "extracts the url" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"I think I just found the best github repo https://github.com/komeiji-satori/Dress"
	})

	object = Object.normalize(activity, fetch: false)
	url = HTML.extract_first_external_url_from_object(object)
	assert url == "https://github.com/komeiji-satori/Dress"
	end

	test "skips mentions" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"@#{other_user.nickname} install misskey! https://github.com/syuilo/misskey/blob/develop/docs/setup.en.md"
	})

	object = Object.normalize(activity, fetch: false)
	url = HTML.extract_first_external_url_from_object(object)

	assert url == "https://github.com/syuilo/misskey/blob/develop/docs/setup.en.md"

	refute url == other_user.ap_id
	end

	test "skips hashtags" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "#cofe https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
	})

	object = Object.normalize(activity, fetch: false)
	url = HTML.extract_first_external_url_from_object(object)

	assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
	end

	test "skips microformats hashtags" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"<a href=\"https://pleroma.gov/tags/cofe\" rel=\"tag\">#cofe</a> https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140",
	content_type: "text/html"
	})

	object = Object.normalize(activity, fetch: false)
	url = HTML.extract_first_external_url_from_object(object)

	assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
	end

	test "does not crash when there is an HTML entity in a link" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "\"http://cofe.com/?boomer=ok&foo=bar\""})

	object = Object.normalize(activity, fetch: false)

	assert nil == HTML.extract_first_external_url_from_object(object)
	end

	test "skips attachment links" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"<a href=\"https://pleroma.gov/media/d24caa3a498e21e0298377a9ca0149a4f4f8b767178aacf837542282e2d94fb1.png?name=image.png\" class=\"attachment\">image.png</a>"
	})

	object = Object.normalize(activity, fetch: false)

	assert nil == HTML.extract_first_external_url_from_object(object)
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sun, Nov 1, 10:00 AM (11 h, 34 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1802937
Default Alt Text: (23 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions