Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Source attribution links when a URL is verifiably safe (Feature 15) #154

Merged
approver_agent merged 3 commits from task/source-attribution-links_c1a97243-3e41-42fc-a1a0-1ac684ccb463 into feature/293a89c5-bd98-4de4-9afd-5ca371e5e679-recipe-detail-and-kitchen-reading-mode 2026-10-09 11:00:16 -04:00
Conversation 3 Commits 3 Files Changed 6
+296 -37
3 Commits
Author SHA1 Message Date
dev_agent b472b35aaa Merge remote-tracking branch 'origin/feature/293a89c5-bd98-4de4-9afd-5ca371e5e679-recipe-detail-and-kitchen-reading-mode' into task/source-attribution-links_c1a97243-3e41-42fc-a1a0-1ac684ccb463
CI / ci (push) Successful in 5m21s
Details
CI / ci (pull_request) Successful in 5m9s
Details
2026-10-09 10:11:16 -04:00
dev_agentandClaude Opus 5.5 0c5772f48e Withhold recipe source urls whose host the browser cannot parse
CI / ci (pull_request) Failing after 4m13s
Details
CI / ci (push) Failing after 4m11s
Details 
safeSourceURL accepted hosts that Go's url.Parse takes but the browser's
URL parser refuses, such as "https://[bad]/curry", so the detail API could
send a source.url that sourceUrl() in web/src/dinners/detail.ts rejects,
failing the whole recipe screen. The server now also requires a host the
browser parses as it stands: a bracketed host must be an IPv6 address
without a zone; any other must be ASCII letters, digits and hyphens in
non-empty dot-separated labels, with no punycode label and, when its last
label is a number, a valid dotted quad; and the host must be spelled out,
not percent-encoded. Any other link is withheld as before.

web/src/dinners/testdata/source_url_cases.json pins the source object
the handler sends for each stored link. The Go server test checks the
handler against it, and the recipe screen test renders each source from
it, so the two parsers cannot drift apart on those links.

Task: c1a97243-3e41-42fc-a1a0-1ac684ccb463

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-09 08:30:22 -04:00
dev_agentandClaude Opus 5.5 9a2de85f75 Return the recipe source url when it is verifiably free of secrets
CI / ci (push) Successful in 5m53s
Details
CI / ci (pull_request) Successful in 5m2s
Details 
The dinner detail API now sends source.url when the stored recipe link
is https to a host with no userinfo, no query (not even a bare "?") and
no fragment (not even a bare "#"), and a port the client can parse;
otherwise source.url is null. The rule matches sourceUrl() in
web/src/dinners/detail.ts, so the recipe screen links "Recipe from
{site}" in a new tab for a safe link and shows plain text otherwise.
The site-name protection in pageSiteName is unchanged.

Task: c1a97243-3e41-42fc-a1a0-1ac684ccb463

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-09 08:07:38 -04:00