b7bc2dbbce
We're currently sending `referrer` with path for image/bookmark requests. We shouldn't do that as it exposes the rooms to other servers. ## `<img>` - `<img>` tags have the right referrerpolicy to be `strict-origin-when-cross-origin`: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/img#referrerpolicy - _however_, because we use React, it looks like react creates a raw DOM node and adds properties one by one and it loses the default referrerpolicy it would otherwise get! So, in `BookmarkShapeUtil` we explicitly state the `referrerpolicy` - `background-image` does the right thing 👍 - _also_, I added this to places we do programmatic `new Image()` ## `fetch` - _however_, fetch does not! wtf. https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch it's almost a footnote in this section of the docs (https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#supplying_request_options) that `no-referrer-when-downgrade` is the default. ## `new Image()` ugh, but _also_ doing a programmatic `new Image()` doesn't do the right thing and we need to set the referrerpolicy here as well ### Change Type <!-- ❗ Please select a 'Scope' label ❗️ --> - [x] `sdk` — Changes the tldraw SDK - [x] `dotcom` — Changes the tldraw.com web app - [ ] `docs` — Changes to the documentation, examples, or templates. - [ ] `vs code` — Changes to the vscode plugin - [ ] `internal` — Does not affect user-facing stuff <!-- ❗ Please select a 'Type' label ❗️ --> - [x] `bugfix` — Bug fix - [ ] `feature` — New feature - [ ] `improvement` — Improving existing features - [ ] `chore` — Updating dependencies, other boring stuff - [ ] `galaxy brain` — Architectural changes - [ ] `tests` — Changes to any test code - [ ] `tools` — Changes to infrastructure, CI, internal scripts, debugging tools, etc. - [ ] `dunno` — I don't know ### Test Plan 1. Test on staging that referrer with path isn't being sent anymore. ### Release Notes - Security: fix referrer being sent for bookmarks and images.
50 lines
2.4 KiB
HTML
50 lines
2.4 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
|
|
<link rel="manifest" href="/manifest.webmanifest" />
|
|
|
|
<meta name="referrer" content="strict-origin-when-cross-origin" />
|
|
<meta name="theme-color" content="#FFFFFF" data-rh="true" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
|
|
<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
|
|
<meta name="application-name" content="tldraw" />
|
|
<meta name="apple-mobile-web-app-capable" content="yes" />
|
|
<meta name="apple-mobile-web-app-status-bar-style" content="default" />
|
|
<meta name="apple-mobile-web-app-title" content="tldraw" />
|
|
<link rel="mask-icon" href="/safari-pinned-tab.svg" color="#FFFFFF" />
|
|
|
|
<meta name="description" content="A free and instant collaborative diagramming tool." />
|
|
<meta name="format-detection" content="telephone=no" />
|
|
<meta name="mobile-web-app-capable" content="yes" />
|
|
<meta name="msapplication-config" content="browserconfig.xml" />
|
|
<meta name="msapplication-TileColor" content="#FFFFFF" />
|
|
<meta name="msapplication-tap-highlight" content="no" />
|
|
|
|
<link rel="apple-touch-icon" href="/apple-touch-icon.png" />
|
|
<link rel="apple-touch-icon" sizes="152x152" href="/apple-touch-icon-152x152.svg" />
|
|
<link rel="apple-touch-icon" sizes="167x167" href="/apple-touch-icon-167x167.svg" />
|
|
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon-180x180.svg" />
|
|
|
|
<meta name="twitter:card" content="summary" />
|
|
<meta name="twitter:url" content="https://www.tldraw.com/" />
|
|
<meta name="twitter:title" content="tldraw" />
|
|
<meta name="twitter:description" content="A free and instant collaborative diagramming tool." />
|
|
<meta name="twitter:image" content="https://www.tldraw.com/social-twitter.png" />
|
|
<meta name="twitter:creator" content="@tldraw" />
|
|
<meta property="og:type" content="website" />
|
|
<meta property="og:title" content="tldraw" />
|
|
<meta property="og:description" content="A free and instant collaborative diagramming tool." />
|
|
<meta property="og:site_name" content="tldraw" />
|
|
<meta property="og:url" content="https://www.tldraw.com/" />
|
|
<meta property="og:image" content="https://www.tldraw.com/social-og.png" />
|
|
<title>tldraw</title>
|
|
</head>
|
|
|
|
<body>
|
|
<div id="root" class="site-wrapper"></div>
|
|
<script type="module" src="./src/main.tsx"></script>
|
|
<noscript>You need to enable JavaScript to run tldraw. ✌️</noscript>
|
|
</body>
|
|
</html>
|