WARNING: CHECK LINKS

As reported to the lemmy devs here there is no sanity checking of links in posts currently in lemmy. Please be careful in the links you click!

Further discussion and context from the reporter here.

cuppaconcrete 9 points 3 years ago

I really wish jerboa could show urls on links for this reason. Are there any other Android clients that do?

save

path: 0 875864, hotness: undefined, score: 9, children: 8

ThatSandwichGuy 4 points 3 years ago

Connect doesn't appear to be.

save

path: 0 875864 875876, hotness: undefined, score: 4, children: 4

Spendies 3 points 3 years ago

It does in card and full width view, just not in list or reverse list view based on my testing just now.

Edit: It shows the domain at least. Jerboa does too in every view in 0.0.38 as far as I can tell.

save

path: 0 875864 875876 882061, hotness: undefined, score: 3, children: 3

w2qw 2 points 3 years ago

Do the android apps have this issue? What would they even do with a JavaScript link?

save

path: 0 875864 875876 882061 882486, hotness: undefined, score: 2, children: 2

cuppaconcrete 1 point 3 years ago

Links in post body and comments don't show URLs so they could easily send ya to a malware site or gore/NSFW/IP logger site.

save

path: 0 875864 875876 882061 882486 973237, hotness: undefined, score: 1, children: 1

Zagorath 4 points 3 years ago

I'm sad that the RIF dev is making a Tildes app next, because the RIF UX around links was absolutely spectacular.

save

path: 0 875864 891905, hotness: undefined, score: 4, children: 0

Kolanaki 3 points 3 years ago

Liftoff shows the domain the link is going to, but not the entire URL. And it only shows up when going to the comments.

save

path: 0 875864 878261, hotness: undefined, score: 3, children: 1

cuppaconcrete 1 point 3 years ago

Good enough! I'll switch to Liftoff today

EDIT: Liftoff isn't showing any website/url previews for the links in the post or comment text but it's working for primary URLs of posts so it's better than nothing lol

EDIT2: Actually Liftoff doesn't do anything more than Jerboa already does. It seems Boost can show URLs before opening a link but it is closed source.

Jerboa feature request: https://github.com/dessalines/jerboa/issues/434

save

path: 0 875864 878261 880067, hotness: undefined, score: 1, children: 0

ThatSandwichGuy 4 points 3 years ago

Sure thanks... Wait a minute.

save

path: 0 875863, hotness: undefined, score: 4, children: 2

No1 4 points 3 years ago

I'm gonna be so disappointed if at least one of those links is not a rickroll lol

save

path: 0 875863 881976, hotness: undefined, score: 4, children: 1

ThatSandwichGuy 2 points 3 years ago

I would be but my school IT taught me better.

save

path: 0 875863 881976 968359, hotness: undefined, score: 2, children: 0

tal 4 points 3 years ago

checks

It looks like kbin does check for and validate these. It hands back an "invalid URL" error if the mentioned javascript: schema in the bug report for lemmy is used.

EDIT: Though I didn't try submitting to a lemmy instance and seeing whether kbin validates links coming in from federated systems rather than locally-submitted.

EDIT2: Honestly, this should be checked in clients too to avoid a malicious server they connect to directly feeding them XSS URLs. Like, probably warrants bug reports for all clients.

save

path: 0 882906, hotness: undefined, score: 4, children: 0

TassieTosser 3 points 3 years ago

Yikes. Thanks for the heads up.

save

path: 0 876073, hotness: undefined, score: 3, children: 0

Treevan 3 points 3 years ago

save

path: 0 878168, hotness: undefined, score: 3, children: 0

lodion 1 point 3 years ago

Unpinning this, as lemmy 0.18.1 includes this update that limits URL links to only being http(s).

Everyone should still be wary of clicking random links on the internet of course.

save

path: 0 963757, hotness: undefined, score: 1, children: 0