misskey-dev/summaly
1
0
Fork 0
mirror of https://github.com/misskey-dev/summaly.git synced 2025-04-29 10:47:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of https://github.com/misskey-dev/summaly

Browse Source
This commit is contained in:
tamaina 2023-04-20 04:02:59 +00:00
commit c7d71a9ec2
4 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
built/general.js
View File

@ -103,6 +103,9 @@ async function getOEmbedPlayer($, pageUrl) {
const allowedPermissions = (iframe.attr('allow') ?? '').split(/\s*;\s*/g) const allowedPermissions = (iframe.attr('allow') ?? '').split(/\s*;\s*/g)
.filter(s => s) .filter(s => s)
.filter(s => !ignoredList.includes(s)); .filter(s => !ignoredList.includes(s));
if (iframe.attr('allowfullscreen') === '') {
allowedPermissions.push('fullscreen');
}
if (allowedPermissions.some(allow => !safeList.includes(allow))) { if (allowedPermissions.some(allow => !safeList.includes(allow))) {
// This iframe is probably too powerful to be embedded // This iframe is probably too powerful to be embedded
return null; return null;

3
src/general.ts
View File

@ -115,6 +115,9 @@ async function getOEmbedPlayer($: cheerio.CheerioAPI, pageUrl: string): Promise<
(iframe.attr('allow') ?? '').split(/\s*;\s*/g) (iframe.attr('allow') ?? '').split(/\s*;\s*/g)
.filter(s => s) .filter(s => s)
.filter(s => !ignoredList.includes(s)); .filter(s => !ignoredList.includes(s));
if (iframe.attr('allowfullscreen') === '') {
allowedPermissions.push('fullscreen');
}
if (allowedPermissions.some(allow => !safeList.includes(allow))) { if (allowedPermissions.some(allow => !safeList.includes(allow))) {
// This iframe is probably too powerful to be embedded // This iframe is probably too powerful to be embedded
return null; return null;

9
test/index.ts
View File

@ -294,7 +294,14 @@ describe("oEmbed", () => {
await setUpFastify('oembed-allow-fullscreen.json'); await setUpFastify('oembed-allow-fullscreen.json');
const summary = await summaly(host); const summary = await summaly(host);
expect(summary.player.url).toBe('https://example.com/'); expect(summary.player.url).toBe('https://example.com/');
expect(summary.player.allow).toStrictEqual(['fullscreen']) expect(summary.player.allow).toStrictEqual(['fullscreen']);
});
test('allows legacy allowfullscreen', async () => {
await setUpFastify('oembed-allow-fullscreen-legacy.json');
const summary = await summaly(host);
expect(summary.player.url).toBe('https://example.com/');
expect(summary.player.allow).toStrictEqual(['fullscreen']);
}); });
test('allows safelisted permissions', async () => { test('allows safelisted permissions', async () => {

7
test/oembed/oembed-allow-fullscreen-legacy.json Normal file
View File

@ -0,0 +1,7 @@
{
"version": "1.0",
"type": "rich",
"html": "<iframe src='https://example.com/' allowfullscreen></iframe>",
"width": 500,
"height": 300
}