~cytrogen/masto-fe

ref: 644c5fddd8d04d3f59a2e9a716614bab748796c3 masto-fe/app/controllers/api/web/embeds_controller.rb -rw-r--r-- 616 bytes
644c5fdd — Matt Jankowski Refactor `Status.tagged_with_all` for brakeman SQL injection warning (#25941) 2 years ago
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# frozen_string_literal: true

class Api::Web::EmbedsController < Api::Web::BaseController
  before_action :require_user!

  def create
    status = StatusFinder.new(params[:url]).status

    return not_found if status.hidden?

    render json: status, serializer: OEmbedSerializer, width: 400
  rescue ActiveRecord::RecordNotFound
    oembed = FetchOEmbedService.new.call(params[:url])

    return not_found if oembed.nil?

    begin
      oembed[:html] = Sanitize.fragment(oembed[:html], Sanitize::Config::MASTODON_OEMBED)
    rescue ArgumentError
      return not_found
    end

    render json: oembed
  end
end