zulip

Author	SHA1	Message	Date
Mateusz Mandera	770086f983	url_preview: Discard url in oembed if server returns invalid json. This fixes the scenario where we'd get errors in the FetchLinksEmbedData queue processor if oembed got invalid json from the URL.	2020-04-11 11:54:54 -07:00
Tim Abbott	4901dc3795	url_preview: Fix parsing of open graph tags. Our open graph parser logic sloppily mixed data obtained by parsing open graph properties with trusted data set by our oembed parser. We fix this by consistenly using our explicit whitelist of generic properties (image, title, and description) in both places where we interact with open graph properties. The fixes are redundant with each other, but doing both helps in making the intent of the code clearer. This issue fixed here was originally reported as an XSS vulnerability in the upcoming Inline URL Previews feature found by Graham Bleaney and Ibrahim Mohamed using Pysa. The recent Oembed changes close that vulnerability, but this change is still worth doing to make the implementation do what it looks like it does.	2019-12-12 15:24:38 -08:00
Anders Kaseorg	faa3ea0b8e	oembed: Remove unsound HTML filtering. The frontend now takes care of confining the HTML. Signed-off-by: Anders Kaseorg <anders@zulipchat.com>	2019-12-12 15:24:38 -08:00
Tim Abbott	9f223bb7c2	url_preview: Simplify path to oembed code.	2019-12-12 13:34:49 -08:00