mirror of
https://github.com/zulip/zulip.git
synced 2026-07-12 21:04:41 +08:00
postprocess_content: Drop invalid inline image elements.
Some checks failed
Code scanning / CodeQL (push) Has been cancelled
Zulip production suite / Ubuntu 22.04 production build (push) Has been cancelled
Zulip CI / ${{ matrix.name }} (zulip/ci:bookworm, true, false, Debian 12 (Python 3.11, backend + documentation), bookworm) (push) Has been cancelled
Zulip CI / ${{ matrix.name }} (zulip/ci:jammy, false, true, Ubuntu 22.04 (Python 3.10, backend + frontend), jammy) (push) Has been cancelled
Zulip CI / ${{ matrix.name }} (zulip/ci:noble, false, false, Ubuntu 24.04 (Python 3.12, backend), noble) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:bookworm, --test-custom-db, Debian 12 production install with custom db name and user, bookworm) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:jammy, , Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga, jammy) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:noble, , Ubuntu 24.04 production install, noble) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:bookworm-7.0, 7.0 Version Upgrade, bookworm) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:bookworm-8.0, 8.0 Version Upgrade, bookworm) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:jammy-6.0, 6.0 Version Upgrade, jammy) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:noble-9.0, 9.0 Version Upgrade, noble) (push) Has been cancelled
Some checks failed
Code scanning / CodeQL (push) Has been cancelled
Zulip production suite / Ubuntu 22.04 production build (push) Has been cancelled
Zulip CI / ${{ matrix.name }} (zulip/ci:bookworm, true, false, Debian 12 (Python 3.11, backend + documentation), bookworm) (push) Has been cancelled
Zulip CI / ${{ matrix.name }} (zulip/ci:jammy, false, true, Ubuntu 22.04 (Python 3.10, backend + frontend), jammy) (push) Has been cancelled
Zulip CI / ${{ matrix.name }} (zulip/ci:noble, false, false, Ubuntu 24.04 (Python 3.12, backend), noble) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:bookworm, --test-custom-db, Debian 12 production install with custom db name and user, bookworm) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:jammy, , Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga, jammy) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:noble, , Ubuntu 24.04 production install, noble) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:bookworm-7.0, 7.0 Version Upgrade, bookworm) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:bookworm-8.0, 8.0 Version Upgrade, bookworm) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:jammy-6.0, 6.0 Version Upgrade, jammy) (push) Has been cancelled
Zulip production suite / ${{ matrix.name }} (zulip/ci:noble-9.0, 9.0 Version Upgrade, noble) (push) Has been cancelled
These shouldn't exist without bugs in the Markdown processor, but at least some ancient messages in chat.zulip.org seem to have them.
This commit is contained in:
parent
d18593b5be
commit
2c8d74735a
@ -112,7 +112,17 @@ export function postprocess_content(html: string): string {
|
||||
// `/user_uploads/thumbnail`, even though that's what the
|
||||
// server writes in the markup, because Firefox will have
|
||||
// already prepended the origin to the source of an image.
|
||||
const image_url = new URL(inline_img.src, window.location.origin);
|
||||
let image_url;
|
||||
try {
|
||||
image_url = new URL(inline_img.src, window.location.origin);
|
||||
} catch {
|
||||
// If the image source URL can't be parsed, likely due to
|
||||
// some historical bug in the Markdown processor, just
|
||||
// drop the invalid image element.
|
||||
inline_img.closest("div.message_inline_image")!.remove();
|
||||
continue;
|
||||
}
|
||||
|
||||
if (
|
||||
image_url.origin === window.location.origin &&
|
||||
image_url.pathname.startsWith("/user_uploads/thumbnail/")
|
||||
|
||||
@ -151,4 +151,18 @@ run_test("message_inline_animated_image_still", ({override}) => {
|
||||
"</a>" +
|
||||
"</div>",
|
||||
);
|
||||
|
||||
// Broken/invalid source URLs in image previews should be
|
||||
// dropped. Inspired by a real message found in chat.zulip.org
|
||||
// history.
|
||||
assert.equal(
|
||||
postprocess_content(
|
||||
'<div class="message_inline_image">' +
|
||||
'<a href="https://zulip.%20[Click%20to%20join%20video%20call](https://meeting.example.com/abcd1234)%20example.com/user_uploads/2/ab/abcd1234/image.png" target="_blank" title="image.png">' +
|
||||
'<img src="https://zulip.%20[Click%20to%20join%20video%20call](https://meeting.example.com/abcd1234)%20example.com/user_uploads/2/ab/abcd1234/image.png">' +
|
||||
"</a>" +
|
||||
"</div>",
|
||||
),
|
||||
"",
|
||||
);
|
||||
});
|
||||
|
||||
Loading…
Reference in New Issue
Block a user