search

brave / ads-ui

Self-service ads UI
Mozilla Public License 2.0
22 stars 11 forks source link

feat(search): show favicon in preview #1182

Closed tackley closed 4 months ago

tackley commented 4 months ago

Relies on https://github.com/brave/ads-serve/pull/3884

Screenshot 2024-05-02 at 12 46 38
github-actions[bot] commented 4 months ago

[puLL-Merge] - brave/ads-ui@1182

Description

This PR adds the favicon field to the SearchLandingPageWithStats fragment and uses it in the SearchPreview component. It allows displaying the favicon associated with a landing page in the search campaign creation UI.

Changes ### Changes - `src/components/Creatives/SearchPreview.tsx`: - Add `favicon` prop to `SearchPreview` component - Display the favicon image inside the URL bar of the search preview - `src/graphql-client/gql.ts`: - Update the `CreateSearchCampaign_LandingPageList` query to include the `favicon` field in the `SearchProspects_LandingPageList` fragment - `src/graphql-client/graphql.ts`: - Update the generated GraphQL types to include `favicon` field in `SearchLandingPage` and `SearchLandingPageWithStats` types - `src/user/views/user/search/CreateSearchCampaign.tsx`: - Update the `CreateSearchCampaign_LandingPageList` fragment to include the `favicon` field - `src/user/views/user/search/LandingPageListEntry.tsx`: - Pass the `favicon` prop from `landingPage` to the `SearchPreview` component

Security Hotspots

  1. Displaying user-supplied favicons could potentially be an XSS vector if not properly sanitized. Ensure the favicon URL is validated and filtered before rendering. Risk: Medium
  2. Fetching favicons from arbitrary origins may expose user activity if not proxied through a secure server. Consider proxying the favicon requests. Risk: Low

Let me know if you have any other questions!

tackley commented 4 months ago
  1. Displaying user-supplied favicons could potentially be an XSS vector if not properly sanitized. Ensure the favicon URL is validated and filtered before rendering. Risk: Medium
  2. Fetching favicons from arbitrary origins may expose user activity if not proxied through a secure server. Consider proxying the favicon requests. Risk: Low

We deliberately use the same image proxy server as search does to display these icons.