comunes/tane
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

feat(chat): disallow links in messages

Browse source 
Local-first chat between people whose web of trust is still forming is a
natural phishing/scam vector, so messages may not contain URLs. A
conservative `containsUrl` rule (explicit scheme, www., or a common-TLD
domain — but not "3.5kg" or "12.30") gates it: the composer warns and
keeps the text for editing, and MessagesCubit.send drops any URL as a
backstop. Incoming text was already non-tappable (plain selectable text).
This commit is contained in:
vjrj 2026-07-11 07:14:58 +02:00
parent 6a6a81e8a2
commit 1ab243f29e
14 changed files with 107 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apps/app_seeds/lib/ui/chat_screen.dart
View file

@ -8,6 +8,7 @@ import 'package:url_launcher/url_launcher.dart';
import '../di/injector.dart';
import '../domain/chat_timeline.dart';
import '../domain/message_rules.dart';
import '../i18n/strings.g.dart';
import '../services/message_store.dart';
import '../services/profile_cache.dart';
@ -173,6 +174,13 @@ class _ChatScreenState extends State<ChatScreen> {
final cubit = _messages;
if (cubit == null || _input.text.trim().isEmpty) return;
final text = _input.text;
// Links aren't allowed — warn and keep the text so it can be edited.
if (containsUrl(text)) {
ScaffoldMessenger.of(context)
..hideCurrentSnackBar()
..showSnackBar(SnackBar(content: Text(context.t.chat.noLinks)));
return;
}
_input.clear();
await cubit.send(text);
}