misty.cafe/mistykey
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Security fixes

Browse source 
Co-Authored-By: dakkar <dakkar@thenautilus.net>
This commit is contained in:
Julia Johannesen 2025-04-27 13:05:09 -04:00
parent 9e13c375c5
commit 0bb4e57b0c
No known key found for this signature in database
GPG key ID: 4A1377AF3E7FBC46
14 changed files with 56 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

7
packages/frontend/src/components/global/MkMfm.ts
View file

@ -20,6 +20,7 @@ import MkGoogle from '@/components/MkGoogle.vue';
import MkSparkle from '@/components/MkSparkle.vue';
import MkA, { MkABehavior } from '@/components/global/MkA.vue';
import { defaultStore } from '@/store.js';
import { clamp } from '@@/js/math.js';
function safeParseFloat(str: unknown): number | null {
if (typeof str !== 'string' || str === '') return null;
@ -309,10 +310,10 @@ export default function (props: MfmProps, { emit }: { emit: SetupContext<MfmEven
style = '';
break;
}
const x = Math.min(safeParseFloat(token.props.args.x) ?? 1, 5);
const y = Math.min(safeParseFloat(token.props.args.y) ?? 1, 5);
const x = clamp(safeParseFloat(token.props.args.x) ?? 1, -5, 5);
const y = clamp(safeParseFloat(token.props.args.y) ?? 1, -5, 5);
style = `transform: scale(${x}, ${y});`;
scale = scale * Math.max(x, y);
scale = scale * Math.max(Math.abs(x), Math.abs(y));
break;
}
case 'fg': {

6
packages/frontend/src/components/global/MkUrl.vue
View file

@ -5,7 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only
<template>
<component
:is="self ? 'MkA' : 'a'" ref="el" :class="$style.root" class="_link" :[attr]="self ? props.url.substring(local.length) : props.url" :rel="rel ?? 'nofollow noopener'" :target="target"
:is="self ? 'MkA' : 'a'" ref="el" :class="$style.root" class="_link" :[attr]="maybeRelativeUrl" :rel="rel ?? 'nofollow noopener'" :target="target"
:behavior="props.navigationBehavior"
@contextmenu.stop="() => {}"
@click.prevent="self ? true : warningExternalWebsite(props.url)"
@ -35,6 +35,7 @@ import { useTooltip } from '@/scripts/use-tooltip.js';
import { isEnabledUrlPreview } from '@/instance.js';
import { MkABehavior } from '@/components/global/MkA.vue';
import { warningExternalWebsite } from '@/scripts/warning-external-website.js';
import { maybeMakeRelative } from '@@/js/url.js';
function safeURIDecode(str: string): string {
try {
@ -53,7 +54,8 @@ const props = withDefaults(defineProps<{
showUrlPreview: true,
});
const self = props.url.startsWith(local);
const maybeRelativeUrl = maybeMakeRelative(props.url, local);
const self = maybeRelativeUrl !== props.url;
const url = new URL(props.url);
if (!['http:', 'https:'].includes(url.protocol)) throw new Error('invalid url');
const el = ref();