vjrj
1ab243f29e
Local-first chat between people whose web of trust is still forming is a natural phishing/scam vector, so messages may not contain URLs. A conservative `containsUrl` rule (explicit scheme, www., or a common-TLD domain — but not "3.5kg" or "12.30") gates it: the composer warns and keeps the text for editing, and MessagesCubit.send drops any URL as a backstop. Incoming text was already non-tappable (plain selectable text).
19 lines
907 B
Dart
19 lines
907 B
Dart
/// Content rules for chat messages.
|
|
///
|
|
/// Links are not allowed in messages: it keeps the local-first, offline chat
|
|
/// free of phishing/scam URLs between people who may not know each other yet
|
|
/// (the web of trust is still forming). Enforced on send; incoming text is never
|
|
/// rendered as a tappable link either (the bubble uses plain selectable text).
|
|
library;
|
|
|
|
/// Matches an obvious URL: an explicit scheme, a `www.` host, or a
|
|
/// `domain.tld` with a common TLD. Kept deliberately conservative so ordinary
|
|
/// text ("3.5kg", "F1 hybrid") doesn't trip it, while real links do.
|
|
final RegExp _urlPattern = RegExp(
|
|
r'(https?://|www\.)\S+'
|
|
r'|\b[\w-]+\.(com|org|net|io|app|dev|es|eu|info|xyz|co|me|gg|link|shop|store|online|site|page|ru|cn|tk)\b',
|
|
caseSensitive: false,
|
|
);
|
|
|
|
/// Whether [text] contains something that looks like a URL.
|
|
bool containsUrl(String text) => _urlPattern.hasMatch(text);
|