Fix malformed HTML causing uncaught error (#13042)

Fix OEmbed preview API leaking existence of private statuses (see #12930)
signup-info-prompt
Eugen Rochko 2020-02-07 15:24:22 +01:00 committed by GitHub
parent 02236332ba
commit a64973aecf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 5 deletions

View File

@ -7,15 +7,21 @@ class Api::Web::EmbedsController < Api::Web::BaseController
def create
status = StatusFinder.new(params[:url]).status
return not_found if status.hidden?
render json: status, serializer: OEmbedSerializer, width: 400
rescue ActiveRecord::RecordNotFound
oembed = FetchOEmbedService.new.call(params[:url])
oembed[:html] = Formatter.instance.sanitize(oembed[:html], Sanitize::Config::MASTODON_OEMBED) if oembed[:html].present?
if oembed
render json: oembed
else
render json: {}, status: :not_found
return not_found if oembed.nil?
begin
oembed[:html] = Formatter.instance.sanitize(oembed[:html], Sanitize::Config::MASTODON_OEMBED)
rescue ArgumentError
return not_found
end
render json: oembed
end
end

View File

@ -46,6 +46,8 @@ class Formatter
def reformat(html)
sanitize(html, Sanitize::Config::MASTODON_STRICT)
rescue ArgumentError
''
end
def plaintext(status)