search

microsoft / PowerToys

Windows system utilities to maximize productivity
MIT License
111.81k stars 6.58k forks source link

Image links are broken for markdown files #31747

Open Legend-Master opened 8 months ago

Legend-Master commented 8 months ago

Microsoft PowerToys version

0.79.0

Installation method

GitHub

Running as admin

Yes

Area(s) with issue?

Peek

Steps to reproduce

Use Peek to open a markdown file that contains an image

✔️ Expected Behavior

Chromium (local links)

image

Visual Studio Code (remote links)

image

❌ Actual Behavior

Chromium (local links)

image

Visual Studio Code (remote links)

image

Other Software

No response

Aaron-Junker commented 8 months ago

We do this for security reasons. However the user should be informed of this like in the Previewer.

image

htcfreek commented 8 months ago

We should add an information about the disabled JavaScript when previewing HTML files too. Because the html file might behave broken without JavaScript.

Legend-Master commented 8 months ago

Is it possible to just allow local images and videos? This alone shouldn't cause any security problems I think

Aaron-Junker commented 8 months ago

Is it possible to just allow local images and videos? This alone shouldn't cause any security problems I think

I would like to disagree. The security concern for other local images is not really there, but imagine the following scenario:

  1. Someone wants to find out your IP Address, but they only have your email
  2. With this enabled they can just send a Markdown file with an image per Mail.
  3. You don't even have to open it, just clicking on the file on Explorer will invoke loading the image
  4. For loading the image a web request will be sent to the attackers server and surprise they have your IP address.

That's why I don't think enabling this would be a good idea.

Legend-Master commented 8 months ago

A remote resource would be a problem, so I asked if allowing just the local images would be possible, as a lot of readme files contain path reference images

If we we can't separate local resources from the remote ones, I agree disable this entirely would be the right choice

Welding-Torch commented 8 months ago

Would be great if a way to fix this was found.

Maybe you can try sending the request to get the image/video data through the default browser (like Chrome)? That way the security of it is handled by Chrome and the previewer gets to show the media.