Support proxying chat images via camo

Camo: https://github.com/atmos/camo.  This has a couple advantages over
just allowing images to be dumped as-is:

  - Prevents mixed-content warnings by allowing the server to proxy HTTP
    images to an HTTPS camo instance
  - Protects users' privacy by not exposing their browser directly to
    the image host
  - Allows the camo proxy to intercept and reject bad image sources
    (URLs that are not actually images, gigapixel-sized images likely to
    DoS users' browsers, etc.)

Whitelisting specific domains is supported for cases where the source is
known to be trustworthy.
This commit is contained in:
Calvin Montgomery 2017-05-28 19:38:43 -07:00
parent f968521936
commit 22a9acfc90
8 changed files with 194 additions and 4 deletions

View file

@ -6,6 +6,7 @@ var util = require("../utilities");
var Flags = require("../flags");
var url = require("url");
var counters = require("../counters");
import { transformImgTags } from '../camo';
const SHADOW_TAG = "[shadow]";
const LINK = /(\w+:\/\/(?:[^:\/\[\]\s]+|\[[0-9a-f:]+\])(?::\d+)?(?:\/[^\/\s]*)*)/ig;
@ -381,7 +382,17 @@ ChatModule.prototype.filterMessage = function (msg) {
}
});
return XSS.sanitizeHTML(result);
let settings = {};
const camoConfig = Config.getCamoConfig();
if (camoConfig.isEnabled()) {
settings = {
transformTags: {
img: transformImgTags.bind(null, camoConfig)
}
};
}
return XSS.sanitizeHTML(result, settings);
};
ChatModule.prototype.sendModMessage = function (msg, minrank) {