feeds-fun 1.22.4 → 1.22.6

package/codespell.toml

@@ -0,0 +1,2 @@
+[tool.codespell]
+ignore-words-list = "alltime,ontext"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feeds-fun",
-  "version": "1.22.4",
+  "version": "1.22.6",
   "author": "Aliaksei Yaletski (Tiendil) <a.eletsky@gmail.com> (https://tiendil.org/)",
   "description": "Frontend for the Feeds Fun — web-based news reader",
   "keywords": [

package/src/components/SimplePagination.vue

@@ -2,13 +2,6 @@
   <div>
     {{ realShowEntries }} of {{ total }}
 
-    <button
-      class="ffun-form-button short ml-2"
-      v-if="canShowMore"
-      @click.prevent="showMore()">
-      next {{ realShowPerPage }}
-    </button>
-
     <button
       class="ffun-form-button short ml-2"
       v-if="canHide"
@@ -16,6 +9,13 @@
       >hide</button
     >
 
+    <button
+      class="ffun-form-button short ml-2"
+      v-if="canShowMore"
+      @click.prevent="showMore()">
+      next {{ realShowPerPage }}
+    </button>
+
     <div
       v-if="counterOnNewLine"
       style="line-height: 0.5rem"

package/src/components/tags/EntryTagsList.vue

@@ -85,14 +85,14 @@
         return 1;
       }
 
-      const aCount = properties.tagsCount[a];
-      const bCount = properties.tagsCount[b];
+      const leftTagCount = properties.tagsCount[a];
+      const rightTagCount = properties.tagsCount[b];
 
-      if (aCount > bCount) {
+      if (leftTagCount > rightTagCount) {
         return -1;
       }
 
-      if (aCount < bCount) {
+      if (leftTagCount < rightTagCount) {
         return 1;
       }
 

package/src/components/tags/TagsFilter.vue

@@ -97,14 +97,14 @@
     const counts = properties.tags;
 
     function tagComparator(a: string, b: string) {
-      const aCount = counts[a];
-      const bCount = counts[b];
+      const leftTagCount = counts[a];
+      const rightTagCount = counts[b];
 
-      if (aCount > bCount) {
+      if (leftTagCount > rightTagCount) {
         return -1;
       }
 
-      if (aCount < bCount) {
+      if (leftTagCount < rightTagCount) {
         return 1;
       }
 

package/src/layouts/SidePanelLayout.vue

@@ -165,7 +165,7 @@
 
     if (globalState.logoutConfirmed) {
       // Redirect to login page in case the user is not logged in.
-      // We redirect to login instead of the main page to be consisten
+      // We redirect to login instead of the main page to be consistent
       // with default API behavior on redirection in case of getting 401 status.
       api.redirectToLogin();
     }

package/src/logic/settings.ts

@@ -4,7 +4,7 @@ export const version = __APP_VERSION__;
 
 export const authRefreshInterval = import.meta.env.VITE_FFUN_AUTH_REFRESH_INTERVAL || 10 * 60 * 1000;
 
-export const blog = import.meta.env.VITE_FFUN_BLOG || "https://blog.feeds.fun";
+export const blog = import.meta.env.VITE_FFUN_BLOG || "https://feeds.fun/blog";
 export const roadmap = import.meta.env.VITE_FFUN_ROADMAP || "https://github.com/users/Tiendil/projects/1";
 export const githubRepo = import.meta.env.VITE_FFUN_GITHUB_REPO || "https://github.com/Tiendil/feeds.fun";
 export const discordInvite = import.meta.env.VITE_FFUN_DISCORD_INVITE || "https://discord.gg/C5RVusHQXy";

package/src/logic/tests/utils.test.ts

@@ -0,0 +1,40 @@
+import {afterEach, describe, expect, it, vi} from "vitest";
+import DOMPurify from "dompurify";
+import {purifyBody, purifyTitle} from "@/logic/utils";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("purifyBody", () => {
+  it("sets required security attributes for links", () => {
+    const raw = '<a href="https://example.com" target="_self" rel="noopener" referrerpolicy="unsafe-url">Example</a>';
+
+    const purified = purifyBody({raw, default_: "No description"});
+
+    expect(purified).toContain('href="https://example.com"');
+    expect(purified).toContain('target="_blank"');
+    expect(purified).toContain('rel="noopener noreferrer nofollow"');
+    expect(purified).toContain('referrerpolicy="strict-origin-when-cross-origin"');
+  });
+});
+
+describe("purifyTitle", () => {
+  it("returns default value for null and empty values", () => {
+    expect(purifyTitle({raw: null, default_: "No title"})).toBe("No title");
+    expect(purifyTitle({raw: "   ", default_: "No title"})).toBe("No title");
+  });
+
+  it("sets required security attributes for links in sanitized output", () => {
+    vi.spyOn(DOMPurify, "sanitize").mockReturnValue(
+      '<a href="https://example.com" target="_self" rel="noopener" referrerpolicy="unsafe-url">Example</a>'
+    );
+
+    const purified = purifyTitle({raw: "Example title", default_: "No title"});
+
+    expect(purified).toContain('href="https://example.com"');
+    expect(purified).toContain('target="_blank"');
+    expect(purified).toContain('rel="noopener noreferrer nofollow"');
+    expect(purified).toContain('referrerpolicy="strict-origin-when-cross-origin"');
+  });
+});

package/src/logic/utils.ts

@@ -2,6 +2,25 @@ import _ from "lodash";
 import type * as t from "@/logic/types";
 import DOMPurify from "dompurify";
 
+const REQUIRED_LINK_ATTRIBUTES = {
+  target: "_blank",
+  rel: "noopener noreferrer nofollow",
+  referrerpolicy: "strict-origin-when-cross-origin"
+} as const;
+
+function hardenLinksSecurityAttributes(html: string) {
+  const parsed = new DOMParser().parseFromString(html, "text/html");
+  const links = parsed.body.querySelectorAll("[href]");
+
+  for (const link of links) {
+    link.setAttribute("target", REQUIRED_LINK_ATTRIBUTES.target);
+    link.setAttribute("rel", REQUIRED_LINK_ATTRIBUTES.rel);
+    link.setAttribute("referrerpolicy", REQUIRED_LINK_ATTRIBUTES.referrerpolicy);
+  }
+
+  return parsed.body.innerHTML;
+}
+
 export function timeSince(date: Date) {
   const now = new Date();
 
@@ -80,6 +99,8 @@ export function purifyTitle({raw, default_}: {raw: string | null; default_: stri
     return default_;
   }
 
+  title = hardenLinksSecurityAttributes(title);
+
   return title;
 }
 
@@ -94,6 +115,8 @@ export function purifyBody({raw, default_}: {raw: string | null; default_: strin
     return default_;
   }
 
+  body = hardenLinksSecurityAttributes(body);
+
   return body;
 }
 
@@ -114,7 +137,7 @@ export function chooseTagByUsage({
     exclude = [];
   }
 
-  const tags = _.toPairs(tagsCount).sort((a, b) => {
+  const tags = _.toPairs(tagsCount).sort((a: [string, number], b: [string, number]) => {
     if (a[1] === b[1]) {
       return a[0].localeCompare(b[0]);
     }

package/src/stores/globalSettings.ts

@@ -73,7 +73,7 @@ export const useGlobalSettingsStore = defineStore("globalSettings", () => {
   // This dict is used for two purposes:
   // - To store settings that anonymous user changes while using the site.
   // - To close fast reactive loop after calling backendSettings.set.
-  //   Without this, setting a setting will cause weired and complex chain
+  //   Without this, setting a setting will cause weird and complex chain
   //   of (re)loading data from the backend.
   var settingsOverrides = ref<{[key in keyof any]: t.UserSettingsValue}>({});
 
@@ -139,19 +139,22 @@ export const useGlobalSettingsStore = defineStore("globalSettings", () => {
     );
   }
 
-  function enumBackendSettings(kind: string, enumProperties: any) {
-    const defaultEntry = _.find([...enumProperties], ([, prop]) => prop.default);
+  function enumBackendSettings<TValue extends t.UserSettingsValue, TProperty extends {default?: boolean}>(
+    kind: string,
+    enumProperties: Map<TValue, TProperty>
+  ) {
+    const defaultEntry = _.find([...enumProperties], ([, prop]: [TValue, TProperty]) => prop.default === true);
 
     if (!defaultEntry) {
       throw new Error(`No default entry found for enum "${kind}"`);
     }
 
-    let defaultValue = defaultEntry[0];
+    let defaultValue: TValue = defaultEntry[0];
 
     return backendSettings(
       kind,
       (rawValue: t.UserSettingsValue) => {
-        return enumProperties.has(rawValue);
+        return enumProperties.has(rawValue as TValue);
       },
       defaultValue
     );

package/vitest.config.ts

@@ -8,6 +8,7 @@ export default mergeConfig(
   defineConfig({
     test: {
       environment: 'jsdom',
+      dir: 'src',
       exclude: [...configDefaults.exclude, 'e2e/*'],
       root: fileURLToPath(new URL('./', import.meta.url))
     }