LibreKAT/Ocideck
LibreKAT/Ocideck
Watch
4
0
Fork
You've already forked Ocideck
 0
Code Issues 3 Pull requests Projects Releases 4 Packages Activity Actions

fix: toets de Vimeo-embed op host in plaats van op contains #543

Merged
brenno merged 1 commit from fix/embed-host into main 2026-07-22 11:43:03 +00:00
Conversation 0 Commits 1 Files changed 2 +109 -3
brenno commented 2026-07-22 11:43:01 +00:00
Owner
Copy link

Summary

Second item from #516. The YouTube branch already compared on host, with a comment above it spelling out exactly why: with a contains, https://youtube.com.kwaadaardig.example/ gets through. The Vimeo branch sitting next to it used contains anyway.

So this was not a gap in knowledge. The reasoning had been done and written down, and applied to one of the two branches.

Changes

  • vimeoPlayerNavigationAllowed — host equality or subdomain suffix, same shape as the YouTube one.
  • Both helpers are now testable. Neither had a single test — the code deciding where an embedded player may navigate to.
  • Fail-closed on unparseable input: not a URL is not the same as harmless.

Verification

Six tests covering both players, both the allowed origins and the lookalike hosts. Mutation-checked: putting contains back makes two of the six fail.

make check green.

Part of #516; seven items left there.

## Summary Second item from #516. The YouTube branch already compared on **host**, with a comment above it spelling out exactly why: with a `contains`, `https://youtube.com.kwaadaardig.example/` gets through. The Vimeo branch sitting next to it used `contains` anyway. So this was not a gap in knowledge. The reasoning had been done and written down, and applied to one of the two branches. ## Changes - `vimeoPlayerNavigationAllowed` — host equality or subdomain suffix, same shape as the YouTube one. - Both helpers are now testable. **Neither had a single test** — the code deciding where an embedded player may navigate to. - Fail-closed on unparseable input: not a URL is not the same as harmless. ## Verification Six tests covering both players, both the allowed origins and the lookalike hosts. **Mutation-checked:** putting `contains` back makes two of the six fail. `make check` green. Part of #516; seven items left there.
fix(beveiliging): toets ook de Vimeo-embed op host in plaats van contains
Some checks failed
CI / Gate (Linux) · Format · Analyze · Coverage (pull_request) Has been cancelled
Details
CI / Test (macos-latest) (pull_request) Has been cancelled
Details
CI / Test (windows-latest) (pull_request) Has been cancelled
Details
CI / Web hardening (pull_request) Has been cancelled
Details
CI / Docs links (pull_request) Has been cancelled
Details
CI / Supply-chain (Trivy · advisory) (pull_request) Has been cancelled
Details
CI / Gate (Linux) · Format · Analyze · Coverage (push) Has been cancelled
Details
CI / Test (macos-latest) (push) Has been cancelled
Details
CI / Test (windows-latest) (push) Has been cancelled
Details
CI / Web hardening (push) Has been cancelled
Details
CI / Docs links (push) Has been cancelled
Details
CI / Supply-chain (Trivy · advisory) (push) Has been cancelled
Details
dd8cd08f88 
De YouTube-tak deed dit al goed en het commentaar erboven legt precies uit
waarom: met een contains glipt https://youtube.com.kwaadaardig.example/
erdoor. De Vimeo-tak ernaast gebruikte tóch contains. De redenering was
gemaakt en op één van de twee takken toegepast.

Beide helpers zijn nu toetsbaar, want geen van beide had een test —
uitgerekend de code die bepaalt waar een embed naartoe mag navigeren.
Rommel wordt geweigerd en niet toegelaten: onparseerbaar is niet hetzelfde
als onschuldig.

Getoetst met een mutatie: terug naar contains laat twee van de zes tests
vallen.

Onderdeel van #516.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
brenno merged commit 0a684812a7 into main 2026-07-22 11:43:03 +00:00
brenno deleted branch fix/embed-host 2026-07-22 11:43:03 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accepted
Assessed and will be built

  
bug
Something is broken

  
declined
Assessed and will not be built

  
docs
Documentation only

  
duplicate
Already tracked elsewhere

  
enhancement
New feature or improvement request

  
good first issue
Small, self-contained, and a good place to start

  
in-progress
Someone is working on this right now. Do not start it in parallel.

  
needs-info
Waiting for the reporter

  
privacy
Personal data can leak. Handled before anything else.

  
security
A weakness someone could use. Handled before anything else.

  
triage
Awaiting assessment

No labels
accepted
bug
declined
docs
duplicate
enhancement
good first issue
in-progress
needs-info
privacy
security
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
LibreKAT/Ocideck!543
No description provided.