comunes/tane
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

feat(chat): disallow links in messages

Browse source 
Local-first chat between people whose web of trust is still forming is a
natural phishing/scam vector, so messages may not contain URLs. A
conservative `containsUrl` rule (explicit scheme, www., or a common-TLD
domain — but not "3.5kg" or "12.30") gates it: the composer warns and
keeps the text for editing, and MessagesCubit.send drops any URL as a
backstop. Incoming text was already non-tappable (plain selectable text).
This commit is contained in:
vjrj 2026-07-11 07:14:58 +02:00
parent 6a6a81e8a2
commit 1ab243f29e
14 changed files with 107 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apps/app_seeds/test/state/messages_cubit_test.dart
View file

@ -100,6 +100,15 @@ void main() {
},
);
test('a message containing a link is not sent', () async {
final transport = FakeMessageTransport();
final cubit = MessagesCubit(transport, peerPubkey: peer, selfPubkey: me);
await cubit.send('check https://evil.example/login');
expect(transport.sent, isEmpty);
expect(cubit.state.messages, isEmpty);
await cubit.close();
});
test('empty/whitespace text is not sent', () async {
final transport = FakeMessageTransport();
final cubit = MessagesCubit(transport, peerPubkey: peer, selfPubkey: me);