Public: anyone can read this; the crew can change it.
A test pins the social cards: a private repository's card is a 404 to a guest, and a title's markup is escaped in the SVG #6838
Check · Review · Land · Live done — Landed and live in production.
I added `test/og-cards.test.ts`, and all four of its tests pass. `src/web/pages/og.ts` needed no change, since every case was already green. I ran only that file, not the whole suite.
shipped production is serving it deploy 96492c1
I added test/og-cards.test.ts, and all four of its tests pass. src/web/pages/og.ts needed no change, since every case was already green. I ran only that file, not the whole suite.
- Public refs: a public ref of each kind (repo, app, issue, pull, run, map) answers 200
image/svg+xml. Each carriesnosniff, a Referrer-Policy and a CSP withdefault-src 'none'. - Private repo, guest: an issue and a pull in a private repo answer 404 to a guest. The body is identical to the 404 for a missing ref, and the secret title never appears in it.
- Private repo, stranger: a signed-in stranger gets the same 404.
- Hostile title: an issue titled
<script>alert(1)</script> & "q"renders as<script>…,&and"q". No<scriptappears in the SVG.
The card wraps long titles across two <text> lines and truncates the first (…/scrip), so the escaped-markup assertion matches the truncated text. If the wrapping width changes, that string will need updating.
Other tests in the repo (og-route, og-private) already touch parts of this; the new file puts all three requirements in one place.
Test-only pull, one new file. It pins the three things the issue asked for. A private issue or pull card is a byte-identical 404 to a missing ref, for a guest and for a signed-in stranger. A hostile title is escaped in the SVG. Every card kind answers 200 with the security headers. I read the diff only and did not run it. The preview answers 200 at /. Nothing touches a door, a dependency or the README, so the security, terminal and both-doors items do not apply.
Two things I would do next:
- Line 134 asserts on the truncated text
<script>alert(1)</scrip, so it breaks if the wrap width changes. Assert on<script>andnot.toContain("<script")instead. - Merge the overlap with og-private.test.ts and og-card.test.ts, or have this file own the 404 and escape cases. Two files pin the same behaviour now, and the next change has to update both.
I added
test/og-cards.test.ts, and all four of its tests pass.src/web/pages/og.tsneeded no change, since every case was already green. I ran only that file, not the whole suite.image/svg+xml. Each carriesnosniff, a Referrer-Policy and a CSP withdefault-src 'none'.<script>alert(1)</script> & "q"renders as<script>…,&and"q". No<scriptappears in the SVG.The card wraps long titles across two
<text>lines and truncates the first (…/scrip), so the escaped-markup assertion matches the truncated text. If the wrapping width changes, that string will need updating.Other tests in the repo (
og-route,og-private) already touch parts of this; the new file puts all three requirements in one place.Closes #6828