Security fixes

Co-Authored-By: dakkar <dakkar@thenautilus.net>

packages/backend/src/core/activitypub/ApRendererService.ts

@@ -496,9 +496,7 @@ export class ApRendererService {
 		const attachment = profile.fields.map(field => ({
 			type: 'PropertyValue',
 			name: field.name,
-			value: (field.value.startsWith('http://') || field.value.startsWith('https://'))
-				? `<a href="${new URL(field.value).href}" rel="me nofollow noopener" target="_blank">${new URL(field.value).href}</a>`
-				: field.value,
+			value: this.mfmService.toHtml(mfm.parse(field.value)),
 		}));
 
 		const emojis = await this.getEmojis(user.emojis);

packages/backend/src/server/web/UrlPreviewService.ts

@@ -52,12 +52,10 @@ export class UrlPreviewService {
 	@bindThis
 	private wrap(url?: string | null): string | null {
 		return url != null
-			? url.match(/^https?:\/\//)
-				? `${this.config.mediaProxy}/preview.webp?${query({
-					url,
-					preview: '1',
-				})}`
-				: url
+			? `${this.config.mediaProxy}/preview.webp?${query({
+				url,
+				preview: '1',
+			})}`
 			: null;
 	}