Commit a64973ae authored by Eugen Rochko's avatar Eugen Rochko Committed by GitHub

Fix malformed HTML causing uncaught error (#13042)

Fix OEmbed preview API leaking existence of private statuses (see #12930)
parent 02236332
......@@ -7,15 +7,21 @@ class Api::Web::EmbedsController < Api::Web::BaseController
def create
status = StatusFinder.new(params[:url]).status
return not_found if status.hidden?
render json: status, serializer: OEmbedSerializer, width: 400
rescue ActiveRecord::RecordNotFound
oembed = FetchOEmbedService.new.call(params[:url])
oembed[:html] = Formatter.instance.sanitize(oembed[:html], Sanitize::Config::MASTODON_OEMBED) if oembed[:html].present?
if oembed
render json: oembed
else
render json: {}, status: :not_found
return not_found if oembed.nil?
begin
oembed[:html] = Formatter.instance.sanitize(oembed[:html], Sanitize::Config::MASTODON_OEMBED)
rescue ArgumentError
return not_found
end
render json: oembed
end
end
......@@ -46,6 +46,8 @@ class Formatter
def reformat(html)
sanitize(html, Sanitize::Config::MASTODON_STRICT)
rescue ArgumentError
''
end
def plaintext(status)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment