Enhance embed URL handling and validation system

[adamsaimi]

Test 4

[adamsaimi]

[Security] Server-Side Request Forgery (SSRF) in poll_feed

• Problem: The open(SiteSetting.feed_polling_url) call lacks URL validation, making it vulnerable to SSRF if the URL is attacker-controlled.
• Fix: Implement strict URL validation (whitelist schemes, restrict public IP ranges, prevent internal network access) before calling open.

[adamsaimi]

[Security] Cross-Site Scripting (XSS) via raw_html cook method

• Problem: The raw_html cook method bypasses sanitization, allowing malicious HTML/JavaScript from imported content to be rendered directly, leading to XSS.
• Fix: Apply robust HTML sanitization (e.g., Sanitize gem) to all external contents before saving and rendering, even when cook_method is raw_html.

[adamsaimi]

[Security] Server-Side Request Forgery (SSRF) in import_remote

• Problem: The open(url).read call in import_remote lacks URL validation, making it vulnerable to SSRF if url is attacker-controlled.
• Fix: Implement strict URL validation (whitelist schemes, restrict public IP ranges, prevent internal network access) before calling open.

[adamsaimi]

[Security] Cross-Site Scripting (XSS) via raw post.cooked rendering

• Problem: Directly rendering raw post.cooked from untrusted external sources allows malicious HTML/JavaScript to execute, leading to XSS.
• Fix: Ensure all raw_html content is thoroughly sanitized against XSS before storage or rendering, or apply a strict sanitization filter at the rendering stage.

[adamsaimi]

[Security] Weak postMessage Origin Validation

• Problem: The indexOf check for e.origin is insufficient, allowing attackers to bypass validation with crafted domains and receive sensitive postMessage data.
• Fix: Implement robust origin validation using exact equality (e.origin === discourseUrl) or by parsing and comparing URL.host properties.

[adamsaimi]

[Architecture] Service Logic in TopicEmbed Model

• Problem: TopicEmbed.import and TopicEmbed.import_remote contain extensive business logic, violating the Single Responsibility Principle and making the model bloated and less maintainable.
• Fix: Extract complex service-like logic (content fetching, parsing, orchestration) into dedicated service objects or modules.

[adamsaimi]

[Security] Weak postMessage Target Origin

• Problem: Using request.referer as targetOrigin for postMessage is insecure, as Referer can be spoofed, leading to information leakage to malicious origins.
• Fix: Set targetOrigin to a fixed, known, and trusted origin (e.g., SiteSetting.embeddable_host) instead of relying on request.referer.

[adamsaimi]

[Architecture] Divergent Post Processing Pipeline for raw_html

• Problem: raw_html posts bypass the standard Plugin::Filter.apply(:after_post_cook) step, creating inconsistencies and potential missed plugin functionality.
• Fix: Re-evaluate the raw_html cook method to ensure it integrates with or explicitly handles the standard post-cooking pipeline, or document the divergence clearly.

[adamsaimi]

[Architecture] Synchronous Job Execution in TopicRetriever

• Problem: TopicRetriever directly calls Jobs::PollFeed.new.execute({}), bypassing the asynchronous job queue and potentially blocking the retriever.
• Fix: Enqueue Jobs::PollFeed properly for background execution to leverage asynchronous processing and avoid blocking TopicRetriever.