diff --git a/js/modules/link_previews.js b/js/modules/link_previews.js index 8837f1d40f..b606a42332 100644 --- a/js/modules/link_previews.js +++ b/js/modules/link_previews.js @@ -216,9 +216,17 @@ const ASCII_PATTERN = new RegExp('[\\u0000-\\u007F]', 'g'); function isLinkSneaky(link) { const domain = getDomain(link); + // If the domain is falsy, something fishy is going on + if (!domain) { + return true; + } - // This is necesary because getDomain returns domains in punycode form. We check whether - // it's available for the StyleGuide. + // Domains cannot contain encoded characters + if (domain.includes('%')) { + return true; + } + + // This is necesary because getDomain returns domains in punycode form. const unicodeDomain = nodeUrl.domainToUnicode ? nodeUrl.domainToUnicode(domain) : domain; diff --git a/test/modules/link_previews_test.js b/test/modules/link_previews_test.js index 6054f8b5f7..78835edd95 100644 --- a/test/modules/link_previews_test.js +++ b/test/modules/link_previews_test.js @@ -371,5 +371,25 @@ describe('Link previews', () => { const actual = isLinkSneaky(link); assert.strictEqual(actual, true); }); + + it('returns true for =', () => { + const link = 'r.id=s.id'; + assert.strictEqual(isLinkSneaky(link), true); + }); + + it('returns true for $', () => { + const link = 'r.id$s.id'; + assert.strictEqual(isLinkSneaky(link), true); + }); + + it('returns true for +', () => { + const link = 'r.id+s.id'; + assert.strictEqual(isLinkSneaky(link), true); + }); + + it('returns true for ^', () => { + const link = 'r.id^s.id'; + assert.strictEqual(isLinkSneaky(link), true); + }); }); });