Fix path for cloud url transformer in documentation editor #12876
Conversation
farmaazon
requested review from
MrFlashAccount,
PabloBuchu,
indiv0 and
somebody1234
as code owners
🧪 Storybook is successfully deployed!📊 Dashboard:
|
| // Here we always display docs from `src/Main.enso` module | ||
| const appliedUrl = new URL(path, 'file:///src') | ||
| if (appliedUrl.protocol !== 'file:') { | ||
| return Promise.resolve(Ok({ url: path })) |
There was a problem hiding this comment.
Do we really want to allow any non-file protocol here? I think users will not need anything other than https/http, and it seems safer not to hotlink images over arbitrary protocols from user-provided content.
There was a problem hiding this comment.
We used to use enso:// protocol for fetching internal files from the project. Under the hood we check that the requested path is in a subfolder of the project (for security reasons)
I think we can use the same approach here.
There was a problem hiding this comment.
There was a problem hiding this comment.
I just copied what is in https://github.com/enso-org/enso/blob/develop/app/gui/src/project-view/components/DocumentationEditor/images.ts#L68
Ok, we should change it there. It would be nice if we could share one implementation of this URL classification/normalization logic, that should probably have a protocol whitelist.
farmaazon
added
the
CI: No changelog needed
Part of the fix for #12800 It is visible in network tab (in this case we don't put additional `/`)  However, as seen in this image, cloud still doesn't handle it: @PabloBuchu is working on that. Nevertheless, this won't hurt and may be merged.
Pull Request Description
Part of the fix for #12800
It is visible in network tab (in this case we don't put additional
/)However, as seen in this image, cloud still doesn't handle it: @PabloBuchu is working on that. Nevertheless, this won't hurt and may be merged.
Important Notes
Checklist
Please ensure that the following checklist has been satisfied before submitting the PR:
Scala,
Java,
TypeScript,
and
Rust
style guides. In case you are using a language not listed above, follow the Rust style guide.
[ ] Unit tests have been written where possible.[ ] If meaningful changes were made to logic or tests affecting Enso Cloud integration in the libraries,or the Snowflake database integration, a run of the Extra Tests has been scheduled.