Support proxying chat images via camo
Camo: https://github.com/atmos/camo. This has a couple advantages over just allowing images to be dumped as-is: - Prevents mixed-content warnings by allowing the server to proxy HTTP images to an HTTPS camo instance - Protects users' privacy by not exposing their browser directly to the image host - Allows the camo proxy to intercept and reject bad image sources (URLs that are not actually images, gigapixel-sized images likely to DoS users' browsers, etc.) Whitelisting specific domains is supported for cases where the source is known to be trustworthy.
This commit is contained in:
parent
f968521936
commit
22a9acfc90
8 changed files with 194 additions and 4 deletions
|
|
@ -6,6 +6,7 @@ var util = require("../utilities");
|
|||
var Flags = require("../flags");
|
||||
var url = require("url");
|
||||
var counters = require("../counters");
|
||||
import { transformImgTags } from '../camo';
|
||||
|
||||
const SHADOW_TAG = "[shadow]";
|
||||
const LINK = /(\w+:\/\/(?:[^:\/\[\]\s]+|\[[0-9a-f:]+\])(?::\d+)?(?:\/[^\/\s]*)*)/ig;
|
||||
|
|
@ -381,7 +382,17 @@ ChatModule.prototype.filterMessage = function (msg) {
|
|||
}
|
||||
});
|
||||
|
||||
return XSS.sanitizeHTML(result);
|
||||
let settings = {};
|
||||
const camoConfig = Config.getCamoConfig();
|
||||
if (camoConfig.isEnabled()) {
|
||||
settings = {
|
||||
transformTags: {
|
||||
img: transformImgTags.bind(null, camoConfig)
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
return XSS.sanitizeHTML(result, settings);
|
||||
};
|
||||
|
||||
ChatModule.prototype.sendModMessage = function (msg, minrank) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue