diff options
| author | Julia <julia@insertdomain.name> | 2025-04-28 19:15:54 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-04-29 08:15:54 +0900 |
| commit | d10fdfe9738b17a9d81037c031b40a2cc4cb8038 (patch) | |
| tree | 54eab11525d76e242bd5bd5b7e95bef48267f6fb /packages/frontend/src/components/MkUserSetupDialog.User.vue | |
| parent | New Crowdin updates (#15897) (diff) | |
| download | sharkey-d10fdfe9738b17a9d81037c031b40a2cc4cb8038.tar.gz sharkey-d10fdfe9738b17a9d81037c031b40a2cc4cb8038.tar.bz2 sharkey-d10fdfe9738b17a9d81037c031b40a2cc4cb8038.zip | |
Merge commit from fork
* SP-2025-03.1 always wrap icon&thumbnail URLs
if they're not HTTP URLs, the frontend won't be able to display them
anyway (`<img src="mailto:…">` or '<div stile="background-image:
url(nntp:…)">` aren't going to work!), so let's always run them through the
media proxy, which will fail harder (fetching a `javascript:` URL
won't do anything in the backend, might do something in the frontend)
and will always protect the client's address in cases like `gemini:`
where the browser could try to fetch
* SP-2025-03.2 use object binding for more styles
interpolating a random (remote-controlled!) string into a `style`
attribute is a bad idea; using VueJS object binding, we should get
proper quoting and therefore safe parse failures instead of CSS
injections / XSS
* SP-2025-03.3 slightly more robust "self" URL handling
parse URLs instead of treating them as strings; this is still not
perfect, but the `URL` class only handles full URLs, not relative
ones, so there's so way to ask it "give me a URL object that
represents this resource relative to this base URL"
notice that passing very weird URLs to `MkUrl` and `MkUrlPreview` will
break the frontend (in dev mode) because there's an untrapped `new
URL(…)` that may explode; production builds seem to safely ignore the
error, though
---------
Co-authored-by: dakkar <dakkar@thenautilus.net>
Diffstat (limited to 'packages/frontend/src/components/MkUserSetupDialog.User.vue')
| -rw-r--r-- | packages/frontend/src/components/MkUserSetupDialog.User.vue | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/packages/frontend/src/components/MkUserSetupDialog.User.vue b/packages/frontend/src/components/MkUserSetupDialog.User.vue index 4accc6183b..54887ba0f0 100644 --- a/packages/frontend/src/components/MkUserSetupDialog.User.vue +++ b/packages/frontend/src/components/MkUserSetupDialog.User.vue @@ -5,7 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only <template> <div v-adaptive-bg class="_panel" style="position: relative;"> - <div :class="$style.banner" :style="user.bannerUrl ? `background-image: url(${user.bannerUrl})` : ''"></div> + <div :class="$style.banner" :style="user.bannerUrl ? { backgroundImage: `url(${user.bannerUrl})` } : ''"></div> <MkAvatar :class="$style.avatar" :user="user" indicator/> <div :class="$style.title"> <div :class="$style.name"><MkUserName :user="user" :nowrap="false"/></div> |