EDIT: Liftoff isn't showing any website/url previews for the links in the post or comment text but it's working for primary URLs of posts so it's better than nothing lol
EDIT2: Actually Liftoff doesn't do anything more than Jerboa already does. It seems Boost can show URLs before opening a link but it is closed source.
It looks like kbin does check for and validate these. It hands back an "invalid URL" error if the mentioned javascript: schema in the bug report for lemmy is used.
EDIT: Though I didn't try submitting to a lemmy instance and seeing whether kbin validates links coming in from federated systems rather than locally-submitted.
EDIT2: Honestly, this should be checked in clients too to avoid a malicious server they connect to directly feeding them XSS URLs. Like, probably warrants bug reports for all clients.
28 Comments
cuppaconcrete@aussie.zone · 9 pts · 3y
I really wish jerboa could show urls on links for this reason. Are there any other Android clients that do?
Zagorath@aussie.zone · 4 pts · 3y
I'm sad that the RIF dev is making a Tildes app next, because the RIF UX around links was absolutely spectacular.
ThatSandwichGuy@aussie.zone · 4 pts · 3y
Connect doesn't appear to be.
Spendies@kbin.social · 3 pts · 3y
It does in card and full width view, just not in list or reverse list view based on my testing just now.
Edit: It shows the domain at least. Jerboa does too in every view in 0.0.38 as far as I can tell.
w2qw@aussie.zone · 2 pts · 3y
Do the android apps have this issue? What would they even do with a JavaScript link?
cuppaconcrete@aussie.zone · 1 pts · 3y
Links in post body and comments don't show URLs so they could easily send ya to a malware site or gore/NSFW/IP logger site.
w2qw@aussie.zone · 2 pts · 3y
True but op is talking about JavaScript links.
Kolanaki@yiffit.net · 3 pts · 3y
Liftoff shows the domain the link is going to, but not the entire URL. And it only shows up when going to the comments.
cuppaconcrete@aussie.zone · 1 pts · 3y
Good enough! I'll switch to Liftoff today
EDIT: Liftoff isn't showing any website/url previews for the links in the post or comment text but it's working for primary URLs of posts so it's better than nothing lol
EDIT2: Actually Liftoff doesn't do anything more than Jerboa already does. It seems Boost can show URLs before opening a link but it is closed source.
Jerboa feature request: https://github.com/dessalines/jerboa/issues/434
tal@kbin.social · 4 pts · 3y
checks
It looks like kbin does check for and validate these. It hands back an "invalid URL" error if the mentioned javascript: schema in the bug report for lemmy is used.
EDIT: Though I didn't try submitting to a lemmy instance and seeing whether kbin validates links coming in from federated systems rather than locally-submitted.
EDIT2: Honestly, this should be checked in clients too to avoid a malicious server they connect to directly feeding them XSS URLs. Like, probably warrants bug reports for all clients.
ThatSandwichGuy@aussie.zone · 4 pts · 3y
Sure thanks... Wait a minute.
No1@aussie.zone · 4 pts · 3y
I'm gonna be so disappointed if at least one of those links is not a rickroll lol
ThatSandwichGuy@aussie.zone · 2 pts · 3y
I would be but my school IT taught me better.
TassieTosser@aussie.zone · 3 pts · 3y
Yikes. Thanks for the heads up.
Treevan@aussie.zone · 3 pts · 3y
lodion@aussie.zone · 1 pts · 3y
Unpinning this, as lemmy 0.18.1 includes this update that limits URL links to only being http(s).
Everyone should still be wary of clicking random links on the internet of course.