checks
It looks like kbin does check for and validate these. It hands back an “invalid URL” error if the mentioned javascript: schema in the bug report for lemmy is used.
EDIT: Though I didn’t try submitting to a lemmy instance and seeing whether kbin validates links coming in from federated systems rather than locally-submitted.
EDIT2: Honestly, this should be checked in clients too to avoid a malicious server they connect to directly feeding them XSS URLs. Like, probably warrants bug reports for all clients.
I really wish jerboa could show urls on links for this reason. Are there any other Android clients that do?
I’m sad that the RIF dev is making a Tildes app next, because the RIF UX around links was absolutely spectacular.
Connect doesn’t appear to be.
It does in card and full width view, just not in list or reverse list view based on my testing just now.
Edit: It shows the domain at least. Jerboa does too in every view in 0.0.38 as far as I can tell.
Do the android apps have this issue? What would they even do with a JavaScript link?
Links in post body and comments don’t show URLs so they could easily send ya to a malware site or gore/NSFW/IP logger site.
True but op is talking about JavaScript links.
Liftoff shows the domain the link is going to, but not the entire URL. And it only shows up when going to the comments.
Sure thanks… Wait a minute.
I’m gonna be so disappointed if at least one of those links is not a rickroll lol
I would be but my school IT taught me better.
