comments

LemmyNet · Oct 11, 2023 · 44d8168 · 44d8168
1 parent 3be2a55
commit 44d8168
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/crates/routes/src/image_proxy.rs b/crates/routes/src/image_proxy.rs
@@ -25,6 +25,8 @@ async fn image_proxy(
   Query(params): Query<ImageProxyParams>,
   context: web::Data<LemmyContext>,
 ) -> LemmyResult<HttpResponse> {
+  // TODO: Check that url corresponds to a federated image so that this can't be abused as a proxy
+  //       for arbitrary purposes.
   let url = decode(&params.url)?.into_owned();
   let image_response = context.client().get(url).send().await?;
 

diff --git a/crates/utils/src/utils/markdown/mod.rs b/crates/utils/src/utils/markdown/mod.rs
@@ -77,7 +77,7 @@ mod tests {
                 "![My linked image](https://lemmy-alpha/image.png \"image alt text\")",
                 "<p><img src=\"https://lemmy-alpha/image.png\" alt=\"My linked image\" title=\"image alt text\" /></p>\n"
             ),
-            // Ensure any custom plugins are added to 'MARKDOWN_PARSER' implementation.
+            // Ensure spoiler plugin is added
             (
                 "basic spoiler",
                 "::: spoiler click to see more\nhow spicy!\n:::\n",