paulandClaude Opus 4.8
b97c82d92e
relUrls() picked MusicBrainz link relations by substring (u.includes("bandcamp.com")) with
no scheme check, so a non-http(s) resource or a look-alike host (https://evilbandcamp.com,
javascript:...bandcamp.com...) could be returned and become an injected link's href. Now:
isHttpUrl() accepts http/https only, and matching is by PARSED hostname (=== host ||
endsWith "."+host). Resolver-only; extension unaffected; pure + unit-tested (18 total green).
Source: plan/steward-linker-security SCOUT 2026-06-17.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
82 lines
3.3 KiB
JavaScript
82 lines
3.3 KiB
JavaScript
// Pure, side-effect-free helpers for the resolver. Kept separate from resolver.js
|
|
// (which has the HTTP-server side effect) so they can be unit-tested with `node --test`
|
|
// without starting a server. The artist-match precision lever lives here.
|
|
|
|
export const norm = (s) => String(s).normalize("NFKC").trim().toLowerCase();
|
|
|
|
export const bandcampSearch = (n) => `https://bandcamp.com/search?q=${encodeURIComponent(n)}&item_type=b`;
|
|
export const spotifySearch = (n) => `https://open.spotify.com/search/${encodeURIComponent(n)}`;
|
|
|
|
// The precision lever: return the result whose name matches the candidate
|
|
// case-insensitively, else null. `minScore` (MusicBrainz) additionally requires a
|
|
// confidence score. Tolerates null/garbage items.
|
|
export function pickArtist(name, items, { minScore = null } = {}) {
|
|
const want = norm(name);
|
|
return (
|
|
(items ?? []).find(
|
|
(a) => a && norm(a.name) === want && (minScore == null || (a.score ?? 0) >= minScore),
|
|
) ?? null
|
|
);
|
|
}
|
|
|
|
// A "/search" url means we don't have a direct artist page (just a search fallback).
|
|
export const isSearchUrl = (url) => typeof url === "string" && url.includes("/search");
|
|
|
|
// Choose the single best link to show: prefer Spotify when the artist is actually ON
|
|
// Spotify (a direct, non-search url); else a direct Bandcamp; else the Spotify search.
|
|
export function primaryOf({ spotify, bandcamp }) {
|
|
if (spotify && !isSearchUrl(spotify)) return { platform: "spotify", url: spotify };
|
|
if (bandcamp && !isSearchUrl(bandcamp)) return { platform: "bandcamp", url: bandcamp };
|
|
return { platform: "spotify", url: spotify };
|
|
}
|
|
|
|
// Link object for a confirmed Spotify hit (direct artist url when present, else search).
|
|
export function spotifyResult(hit) {
|
|
const r = {
|
|
name: hit.name,
|
|
spotify: hit.external_urls?.spotify ?? spotifySearch(hit.name),
|
|
bandcamp: bandcampSearch(hit.name),
|
|
};
|
|
return { ...r, primary: primaryOf(r) };
|
|
}
|
|
|
|
// True for http/https URLs only — reject javascript:, ftp:, garbage. These values flow
|
|
// into an injected link's href, so validate the third-party MB data defensively.
|
|
export function isHttpUrl(u) {
|
|
try {
|
|
const p = new URL(u).protocol;
|
|
return p === "https:" || p === "http:";
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
// Extract direct links from a MusicBrainz artist's url-relations (zero-cred: MB stores
|
|
// official Bandcamp / streaming URLs). Accepts only http(s) and matches by parsed hostname
|
|
// (not substring, so "evilbandcamp.com" / "javascript:…bandcamp.com…" don't slip through).
|
|
// Either field may be null.
|
|
export function relUrls(relations) {
|
|
const urls = (relations ?? []).map((r) => r && r.url && r.url.resource).filter(isHttpUrl);
|
|
const byHost = (host) =>
|
|
urls.find((u) => {
|
|
try {
|
|
const h = new URL(u).hostname;
|
|
return h === host || h.endsWith("." + host);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}) ?? null;
|
|
return { bandcamp: byHost("bandcamp.com"), spotify: byHost("open.spotify.com") };
|
|
}
|
|
|
|
// Link object for a confirmed MusicBrainz hit: prefer the direct url-rel links, fall back
|
|
// to search urls when MB has no relation for that platform.
|
|
export function mbResult(hit, links) {
|
|
const r = {
|
|
name: hit.name,
|
|
spotify: links?.spotify ?? spotifySearch(hit.name),
|
|
bandcamp: links?.bandcamp ?? bandcampSearch(hit.name),
|
|
};
|
|
return { ...r, primary: primaryOf(r) };
|
|
}
|