nodebb-plugin-link-preview not working after NodeBB updated to 4.14.4
-
Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works
-
Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works
Did you Upgrade node js?
See Here: https://community.nodebb.org/topic/17384/nodebb-plugin-link-preview-rich-embeds-and-link-previews/71
-
Did you Upgrade node js?
See Here: https://community.nodebb.org/topic/17384/nodebb-plugin-link-preview-rich-embeds-and-link-previews/71
@dave1904 I am using docker deploy
-
Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works
(Tested on my dev environment and confirmed)
This is due to link-preview-js 4.0.4 module bug (reported at https://github.com/OP-Engineering/link-preview-js/issues/182)
For proper fix, NodeBB need to embed 5.x which fix this issue
For immediate fix, modify /usr/src/app/node_modules/link-preview-js/build/index.js
Replace
const parsedUrl = new URL(url); parsedUrl.hostname = formatHostnameForUrl(resolvedAddress); return parsedUrl.href;with
return url;This will return to 4.0.3 approach
Potential risk (by AI):
an attacker who controls DNS for a domain they post returns a public IP to resolveDNSHost (passes throwOnLoopback), then returns an internal IP milliseconds later when fetch re-resolves. The fetched internal service's HTML/text would render into a preview card → SSRF data-exfiltration channel.Risk is low:
- Requires authenticated posting + a reliable rebinding race (hard to time) — not a trivial drive-by.
- Cloud metadata (169.254.169.254) and all RFC-1918 ranges are still blocked on the first resolution. The exposure is the second resolution only.
-
(Tested on my dev environment and confirmed)
This is due to link-preview-js 4.0.4 module bug (reported at https://github.com/OP-Engineering/link-preview-js/issues/182)
For proper fix, NodeBB need to embed 5.x which fix this issue
For immediate fix, modify /usr/src/app/node_modules/link-preview-js/build/index.js
Replace
const parsedUrl = new URL(url); parsedUrl.hostname = formatHostnameForUrl(resolvedAddress); return parsedUrl.href;with
return url;This will return to 4.0.3 approach
Potential risk (by AI):
an attacker who controls DNS for a domain they post returns a public IP to resolveDNSHost (passes throwOnLoopback), then returns an internal IP milliseconds later when fetch re-resolves. The fetched internal service's HTML/text would render into a preview card → SSRF data-exfiltration channel.Risk is low:
- Requires authenticated posting + a reliable rebinding race (hard to time) — not a trivial drive-by.
- Cloud metadata (169.254.169.254) and all RFC-1918 ranges are still blocked on the first resolution. The exposure is the second resolution only.
@jasonwch I blame AI for exposing DNS rebinding as a problem at all.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login