-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Media Resolver #427
Add Media Resolver #427
Conversation
Codecov Report
@@ Coverage Diff @@
## master #427 +/- ##
==========================================
+ Coverage 44.62% 45.66% +1.03%
==========================================
Files 101 103 +2
Lines 3742 3832 +90
==========================================
+ Hits 1670 1750 +80
- Misses 2024 2032 +8
- Partials 48 50 +2
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
I would want to think a bit more what data makes sense to pass along to the user. File type: Image (PNG) File Type: Text (JSON)? Some tests for the media resolver to ensure we test the various media types we thing are most important would be nice |
response := &resolver.Response{ | ||
Status: http.StatusOK, | ||
Link: targetURL, | ||
Tooltip: tooltip.String(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I removed the PathEscape here and it still works fine in Chatterino. Is there any actual need for it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It'll be necessary to make sure any already-escaped strings aren't unescaped by Chatterino.
When Chatterino parses this tooltip it runs a single unescape
path.
If we don't call url.PathEscape
here, our bad actor tooltip might look like this:
<div>tooltip: %3Cscript%20src=xd.js%3E</div>
, and Chatterino's single unescape call will turn that into <div>tooltip: <script src=xd.js></div>
If we call url.PathEscape
here, our bad actor tooltip would look like this:
%3Cdiv%3Etooltip: %253Cscript%2520src=xd.js%253E%3C%2Fdiv%3E
and Chatterino would turn that into <div>tooltip: %3Cscript%20src=xd.js%3E</div>
effectively 'nullifying' the bad actor's html tags.
This could be better solved by never sending actual HTML to Chatterino but this is where we're at 👯
|
response := &resolver.Response{ | ||
Status: http.StatusOK, | ||
Link: targetURL, | ||
Tooltip: tooltip.String(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It'll be necessary to make sure any already-escaped strings aren't unescaped by Chatterino.
When Chatterino parses this tooltip it runs a single unescape
path.
If we don't call url.PathEscape
here, our bad actor tooltip might look like this:
<div>tooltip: %3Cscript%20src=xd.js%3E</div>
, and Chatterino's single unescape call will turn that into <div>tooltip: <script src=xd.js></div>
If we call url.PathEscape
here, our bad actor tooltip would look like this:
%3Cdiv%3Etooltip: %253Cscript%2520src=xd.js%253E%3C%2Fdiv%3E
and Chatterino would turn that into <div>tooltip: %3Cscript%20src=xd.js%3E</div>
effectively 'nullifying' the bad actor's html tags.
This could be better solved by never sending actual HTML to Chatterino but this is where we're at 👯
Just need that pathescape back, otherwise works as expected for me |
Pull request checklist:
CHANGELOG.md
was updated, if applicableDescription
Add Tooltip-only Resolver for previously unsupported Media files. Particularly useful for file uploaders that do not show the file extension.