Skip to content

Commit db5c127

Browse files
fix(backend): fix handling of invalid urls in user profile (#15635)
Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
1 parent 0402866 commit db5c127

File tree

2 files changed

+19
-2
lines changed

2 files changed

+19
-2
lines changed

CHANGELOG.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- 自動でバックアップされるように
99

1010
### Server
11-
-
11+
- Fix: プロフィール追加情報で無効なURLに入力された場合に照会エラーを出るのを修正
1212

1313

1414
## 2025.3.1

packages/backend/src/core/activitypub/ApRendererService.ts

+18-1
Original file line numberDiff line numberDiff line change
@@ -499,11 +499,28 @@ export class ApRendererService {
499499
this.userProfilesRepository.findOneByOrFail({ userId: user.id }),
500500
]);
501501

502+
const tryRewriteUrl = (maybeUrl: string) => {
503+
const urlSafeRegex = /^(?:http[s]?:\/\/.)?(?:www\.)?[-a-zA-Z0-9@%._\+~#=]{2,256}\.[a-z]{2,6}\b(?:[-a-zA-Z0-9@:%_\+.~#?&\/\/=]*)/;
504+
try {
505+
const match = maybeUrl.match(urlSafeRegex);
506+
if (!match) {
507+
return maybeUrl;
508+
}
509+
const urlPart = match[0];
510+
const urlPartParsed = new URL(urlPart);
511+
const restPart = maybeUrl.slice(match[0].length);
512+
513+
return `<a href="${urlPartParsed.href}" rel="me nofollow noopener" target="_blank">${urlPart}</a>${restPart}`;
514+
} catch (e) {
515+
return maybeUrl;
516+
}
517+
};
518+
502519
const attachment = profile.fields.map(field => ({
503520
type: 'PropertyValue',
504521
name: field.name,
505522
value: (field.value.startsWith('http://') || field.value.startsWith('https://'))
506-
? `<a href="${new URL(field.value).href}" rel="me nofollow noopener" target="_blank">${new URL(field.value).href}</a>`
523+
? tryRewriteUrl(field.value)
507524
: field.value,
508525
}));
509526

0 commit comments

Comments
 (0)