Security fixes

Co-Authored-By: dakkar <dakkar@thenautilus.net>
This commit is contained in:
Julia Johannesen 2025-04-27 13:05:09 -04:00
parent 9e13c375c5
commit 0bb4e57b0c
No known key found for this signature in database
GPG key ID: 4A1377AF3E7FBC46
14 changed files with 56 additions and 26 deletions

View file

@ -5,7 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only
<template>
<component
:is="self ? 'MkA' : 'a'" ref="el" style="word-break: break-all;" class="_link" :[attr]="self ? url.substring(local.length) : url" :rel="rel ?? 'nofollow noopener'" :target="target"
:is="self ? 'MkA' : 'a'" ref="el" style="word-break: break-all;" class="_link" :[attr]="maybeRelativeUrl" :rel="rel ?? 'nofollow noopener'" :target="target"
:behavior="props.navigationBehavior"
:title="url"
@click.prevent="self ? true : warningExternalWebsite(url)"
@ -24,6 +24,7 @@ import * as os from '@/os.js';
import { isEnabledUrlPreview } from '@/instance.js';
import { MkABehavior } from '@/components/global/MkA.vue';
import { warningExternalWebsite } from '@/scripts/warning-external-website.js';
import { maybeMakeRelative } from '@@/js/url.js';
const props = withDefaults(defineProps<{
url: string;
@ -32,7 +33,8 @@ const props = withDefaults(defineProps<{
}>(), {
});
const self = props.url.startsWith(local);
const maybeRelativeUrl = maybeMakeRelative(props.url, local);
const self = maybeRelativeUrl !== props.url;
const attr = self ? 'to' : 'href';
const target = self ? null : '_blank';