Closed ghost closed 5 years ago
Ok
I updated this issue, please review and check
Current content processing is extremely bad An another link in text or even an extra space char will misparse the whole content
The algorithm should be:
There is also should be img onerror
handling which can replace XHR request
The code also contains inappropriate flaws :
if(demotivate_matches != null){
if(img_matches != null){
Exceeded if-else usage
if ((/\.(gif|jpg|jpeg|tiff|png)$/i).test(img) && validationImg(img)) {
} else {
} else {
message = message.replace(img, default_Incorrect_img);
}
}
return message;
let img = img_matches[1];
var content = demotivate_matches[1];
@widedeveloper expecting bugfix
I have no idea how broken img urls could become that big problem Server validation is barely useful and potentially dangerous
Current vue solution is basically the same thing but on client side It's still possible to post a broken img through third-party socket.io client
A simple img onerror attribute can be putted on View side handling broken img links and potentially gather statistics from client side for deleting those
@nl169 , so we should not send XMLHttpRequest when render message on view side
I removed the valid request and instead of I added use onerrror attr in image tag
onerror="this.onerror=null;this.src='/images/incorrect_img.png';"
but it's showing console error for loading image also.
Previous solutions doesn't handle it either
The security-wise issue was fixed
Any non-image urls still will be considered as an image A lot of image hosts are using 302 redirect code so some images will be considered as invalid
The entire site's host/domain may be marked as malicious if someone will spam that tag With CURLOPT_NOBODY it's still possible to just put a huge no-sense link into GET request to make website look even more malicious-like
I'd suggest to remove the code ASAP and rewrite an images validation on the View side