CRT
27a3b233f0
The YouTube-only field becomes a general embed address, made natively only for the frame hosts X's chat CSP allows (www.youtube.com, player.vimeo.com, w.soundcloud.com) and re-checked in the page. A link to an image previews the image itself. YouTube's thumbnail comes as data.
53 lines
4 KiB
TypeScript
53 lines
4 KiB
TypeScript
// Chat+ link previews (src/areas/chat/linkPreviews.ts; native side src-tauri/src/link_preview.rs):
|
|
// which links are asked about, how a native answer is checked again before it becomes page text,
|
|
// and which of X's cards a preview stands in for. Nothing here touches the network or x.com.
|
|
import assert from 'node:assert/strict';
|
|
import { readFileSync } from 'node:fs';
|
|
import test from 'node:test';
|
|
import { asPreview, isBareCard, previewable } from '../src/areas/chat/linkPreviews.ts';
|
|
|
|
test('link previews: only plain https links to hosts that are not X\'s own', () => {
|
|
assert.equal(previewable('https://www.youtube.com/watch?v=dQw4w9WgXcQ'), 'https://www.youtube.com/watch?v=dQw4w9WgXcQ');
|
|
assert.equal(previewable('https://fishies.lol/'), 'https://fishies.lol/');
|
|
for (const bad of [
|
|
'http://example.com/', 'https://user:pw@example.com/', 'https://example.com:8443/', 'https://192.168.0.1/', 'https://[::1]/',
|
|
'https://intranet/', 'https://x.com/a/status/1', 'https://t.co/abc', 'https://pbs.twimg.com/media/a.jpg', 'javascript:alert(1)', '/i/chat/1-2', '', null,
|
|
]) assert.equal(previewable(bad), null, String(bad));
|
|
});
|
|
|
|
test('link previews: a native answer is checked again: plain fields, capped, data: images of four types, an 11-character video id', () => {
|
|
const good = asPreview({ url: 'https://fishies.lol/', site: 'Fishies', title: 'The social aquarium', description: 'x'.repeat(400), image: 'data:image/png;base64,iVBORw0KGgo=' });
|
|
assert.ok(good);
|
|
assert.equal(good.description.length, 300);
|
|
assert.equal(good.image, 'data:image/png;base64,iVBORw0KGgo=');
|
|
assert.equal(asPreview({ url: 'https://a.example/', title: 't', image: 'data:image/svg+xml;base64,PHN2Zz4=' })?.image, undefined, 'no SVG');
|
|
assert.equal(asPreview({ url: 'https://a.example/', title: 't', image: 'https://tracker.example/p.gif' })?.image, undefined, 'no remote image');
|
|
for (const embed of [
|
|
'https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1&rel=0',
|
|
'https://player.vimeo.com/video/76979871?autoplay=1',
|
|
'https://w.soundcloud.com/player/?url=https%3A%2F%2Fsoundcloud.com%2Fcrtkafa%2Fsets%2Falbums&auto_play=true&visual=true',
|
|
]) assert.equal(asPreview({ url: 'https://a.example/', title: 't', embed })?.embed, embed, embed);
|
|
for (const embed of ['https://evil.example/embed', 'https://www.youtube.com/embed/a"onload="x', 'javascript:alert(1)', 'https://open.spotify.com/embed/track/1'])
|
|
assert.equal(asPreview({ url: 'https://a.example/', title: 't', embed })?.embed, undefined, embed);
|
|
assert.equal(asPreview({ url: 'javascript:alert(1)', title: 't' }), null, 'the link itself is re-checked');
|
|
assert.equal(asPreview({ url: 'https://a.example/', title: '' }), null, 'nothing to show, no card');
|
|
assert.equal(asPreview('nope'), null);
|
|
});
|
|
|
|
test('link previews: X\'s bare card (a host name and an icon) is replaced; a card with its own picture or a sentence is not', () => {
|
|
const anchor = (text: string, media = false) => ({ textContent: text, querySelector: () => (media ? {} : null) }) as unknown as Element;
|
|
assert.equal(isBareCard(anchor('www.youtube.com')), true);
|
|
assert.equal(isBareCard(anchor('fishies.lol')), true);
|
|
assert.equal(isBareCard(anchor('www.youtube.com', true)), false);
|
|
assert.equal(isBareCard(anchor('watch this video')), false);
|
|
assert.equal(isBareCard(anchor('www.youtube.com/watch?v=jNQXAC9IVRw')), false, 'a link in the text (live 2026-10-10) stays');
|
|
assert.equal(isBareCard(anchor('')), false);
|
|
});
|
|
|
|
test('link previews: page text only through textContent, players only on the hosts X allows as frames, no request from the page', () => {
|
|
const source = readFileSync(new URL('../src/areas/chat/linkPreviews.ts', import.meta.url), 'utf8');
|
|
assert.doesNotMatch(source, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
|
|
assert.doesNotMatch(source, /\bfetch\(|XMLHttpRequest|WebSocket|sendBeacon/);
|
|
assert.doesNotMatch(source, /i\.ytimg\.com/, 'thumbnails come as data from native code');
|
|
assert.match(source, /rel = 'noopener noreferrer'/);
|
|
});
|