Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse

NodeBB

  1. Home
  2. Bug Reports
  3. nodebb-plugin-link-preview not working after NodeBB updated to 4.14.4

nodebb-plugin-link-preview not working after NodeBB updated to 4.14.4

Scheduled Pinned Locked Moved Bug Reports
5 Posts 3 Posters 0 Views
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J This user is from outside of this forum
    J This user is from outside of this forum
    jasonwch@community.nodebb.org
    wrote last edited by
    #1

    Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works

    dave1904@community.nodebb.orgD J 2 Replies Last reply
    0
    • J jasonwch@community.nodebb.org

      Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works

      dave1904@community.nodebb.orgD This user is from outside of this forum
      dave1904@community.nodebb.orgD This user is from outside of this forum
      dave1904@community.nodebb.org
      wrote last edited by
      #2

      Did you Upgrade node js?

      See Here: https://community.nodebb.org/topic/17384/nodebb-plugin-link-preview-rich-embeds-and-link-previews/71

      J 1 Reply Last reply
      0
      • dave1904@community.nodebb.orgD dave1904@community.nodebb.org

        Did you Upgrade node js?

        See Here: https://community.nodebb.org/topic/17384/nodebb-plugin-link-preview-rich-embeds-and-link-previews/71

        J This user is from outside of this forum
        J This user is from outside of this forum
        jasonwch@community.nodebb.org
        wrote last edited by
        #3

        @dave1904 I am using docker deploy

        1 Reply Last reply
        0
        • J jasonwch@community.nodebb.org

          Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works

          J This user is from outside of this forum
          J This user is from outside of this forum
          jasonwch@community.nodebb.org
          wrote last edited by
          #4

          (Tested on my dev environment and confirmed)

          This is due to link-preview-js 4.0.4 module bug (reported at https://github.com/OP-Engineering/link-preview-js/issues/182)

          For proper fix, NodeBB need to embed 5.x which fix this issue

          For immediate fix, modify /usr/src/app/node_modules/link-preview-js/build/index.js

          Replace

              const parsedUrl = new URL(url);
              parsedUrl.hostname = formatHostnameForUrl(resolvedAddress);
              return parsedUrl.href;
          

          with

          return url;
          

          This will return to 4.0.3 approach

          Potential risk (by AI):
          an attacker who controls DNS for a domain they post returns a public IP to resolveDNSHost (passes throwOnLoopback), then returns an internal IP milliseconds later when fetch re-resolves. The fetched internal service's HTML/text would render into a preview card → SSRF data-exfiltration channel.

          Risk is low:

          • Requires authenticated posting + a reliable rebinding race (hard to time) — not a trivial drive-by.
          • Cloud metadata (169.254.169.254) and all RFC-1918 ranges are still blocked on the first resolution. The exposure is the second resolution only.
          julian@community.nodebb.orgJ 1 Reply Last reply
          0
          • J jasonwch@community.nodebb.org

            (Tested on my dev environment and confirmed)

            This is due to link-preview-js 4.0.4 module bug (reported at https://github.com/OP-Engineering/link-preview-js/issues/182)

            For proper fix, NodeBB need to embed 5.x which fix this issue

            For immediate fix, modify /usr/src/app/node_modules/link-preview-js/build/index.js

            Replace

                const parsedUrl = new URL(url);
                parsedUrl.hostname = formatHostnameForUrl(resolvedAddress);
                return parsedUrl.href;
            

            with

            return url;
            

            This will return to 4.0.3 approach

            Potential risk (by AI):
            an attacker who controls DNS for a domain they post returns a public IP to resolveDNSHost (passes throwOnLoopback), then returns an internal IP milliseconds later when fetch re-resolves. The fetched internal service's HTML/text would render into a preview card → SSRF data-exfiltration channel.

            Risk is low:

            • Requires authenticated posting + a reliable rebinding race (hard to time) — not a trivial drive-by.
            • Cloud metadata (169.254.169.254) and all RFC-1918 ranges are still blocked on the first resolution. The exposure is the second resolution only.
            julian@community.nodebb.orgJ This user is from outside of this forum
            julian@community.nodebb.orgJ This user is from outside of this forum
            julian@community.nodebb.org
            wrote last edited by
            #5

            @jasonwch I blame AI for exposing DNS rebinding as a problem at all.

            1 Reply Last reply
            0

            Hello! It looks like you're interested in this conversation, but you don't have an account yet.

            Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.

            With your input, this post could be even better 💗

            Register Login
            Reply
            • Reply as topic
            Log in to reply
            • Oldest to Newest
            • Newest to Oldest
            • Most Votes


            • Login

            • Login or register to search.
            Powered by NodeBB Contributors
            • First post
              Last post
            0
            • Categories
            • Recent
            • Tags
            • Popular
            • World
            • Users
            • Groups