This commit is contained in:
MildlyMeticulous 2026-08-07 09:46:59 -07:00 committed by GitHub
commit ef76f31a69
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 34 additions and 10 deletions

View file

@ -120,6 +120,12 @@ internal class ExportContext(DiscordClient discord, ExportRequest request)
public Color? TryGetUserColor(Snowflake id) =>
GetUserRoles(id).Where(r => r.Color is not null).Select(r => r.Color).FirstOrDefault();
public static string? EnsureSafeUrl(string? url) =>
Uri.TryCreate(url, UriKind.Absolute, out var uri)
&& (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps)
? url
: null;
public async ValueTask<string> ResolveAssetUrlAsync(
string url,
CancellationToken cancellationToken = default

View file

@ -188,12 +188,19 @@ internal partial class HtmlMarkdownVisitor(
.Groups[1]
.Value;
var safeUrl = ExportContext.EnsureSafeUrl(link.Url);
if (string.IsNullOrWhiteSpace(safeUrl))
{
await VisitAsync(link.Children, cancellationToken);
return;
}
buffer.Append(
!string.IsNullOrWhiteSpace(linkedMessageId)
// lang=html
? $"""<a href="{HtmlEncode(link.Url)}" onclick="scrollToMessage(event, '{linkedMessageId}')">"""
? $"""<a href="{HtmlEncode(safeUrl)}" onclick="scrollToMessage(event, '{linkedMessageId}')">"""
// lang=html
: $"""<a href="{HtmlEncode(link.Url)}">"""
: $"""<a href="{HtmlEncode(safeUrl)}">"""
);
await VisitAsync(link.Children, cancellationToken);

View file

@ -24,6 +24,9 @@
string FormatDate(DateTimeOffset instant, string format = "g") =>
Context.FormatDate(instant, format);
string? EnsureSafeUrl(string? url) =>
ExportContext.EnsureSafeUrl(url);
async ValueTask<IEncodedContent> FormatMarkdownAsync(string markdown) =>
Context.Request.ShouldFormatMarkdown
? Html.Raw(await HtmlMarkdownVisitor.FormatAsync(Context, markdown, true, CancellationToken))
@ -484,9 +487,10 @@
@if (!string.IsNullOrWhiteSpace(embed.Author.Name))
{
if (!string.IsNullOrWhiteSpace(embed.Author.Url))
var authorUrl = EnsureSafeUrl(embed.Author.Url);
if (!string.IsNullOrWhiteSpace(authorUrl))
{
<a class="chatlog__embed-author-link" href="@embed.Author.Url">
<a class="chatlog__embed-author-link" href="@authorUrl">
<div class="chatlog__embed-author">@embed.Author.Name</div>
</a>
}
@ -502,9 +506,12 @@
@if (!string.IsNullOrWhiteSpace(embed.Title))
{
<div class="chatlog__embed-title">
@if (!string.IsNullOrWhiteSpace(embed.Url))
@{
var titleUrl = EnsureSafeUrl(embed.Url);
}
@if (!string.IsNullOrWhiteSpace(titleUrl))
{
<a class="chatlog__embed-title-link" href="@embed.Url">
<a class="chatlog__embed-title-link" href="@titleUrl">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div>
</a>
}
@ -604,9 +611,10 @@
@if (!string.IsNullOrWhiteSpace(embed.Author.Name))
{
if (!string.IsNullOrWhiteSpace(embed.Author.Url))
var authorUrl = EnsureSafeUrl(embed.Author.Url);
if (!string.IsNullOrWhiteSpace(authorUrl))
{
<a class="chatlog__embed-author-link" href="@embed.Author.Url">
<a class="chatlog__embed-author-link" href="@authorUrl">
<div class="chatlog__embed-author">@embed.Author.Name</div>
</a>
}
@ -622,9 +630,12 @@
@if (!string.IsNullOrWhiteSpace(embed.Title))
{
<div class="chatlog__embed-title">
@if (!string.IsNullOrWhiteSpace(embed.Url))
@{
var titleUrl = EnsureSafeUrl(embed.Url);
}
@if (!string.IsNullOrWhiteSpace(titleUrl))
{
<a class="chatlog__embed-title-link" href="@embed.Url">
<a class="chatlog__embed-title-link" href="@titleUrl">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div>
</a>
}