From 7029d88443973feb93eb2620330bd805c88f1cf7 Mon Sep 17 00:00:00 2001 From: Konstantinos Pittas Date: Wed, 5 Apr 2023 21:43:22 +0300 Subject: [PATCH] [MM-51034] Sanitize embedded posts transmitted over WS (#22424) Co-authored-by: Mattermost Build --- server/channels/app/post.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/server/channels/app/post.go b/server/channels/app/post.go index 3e360bc863..35d6f8b6d6 100644 --- a/server/channels/app/post.go +++ b/server/channels/app/post.go @@ -547,6 +547,16 @@ func (a *App) SendEphemeralPost(c request.CTX, userID string, post *model.Post) post = a.PreparePostForClientWithEmbedsAndImages(c, post, true, false, true) post = model.AddPostActionCookies(post, a.PostActionCookieSecret()) + sanitizedPost, appErr := a.SanitizePostMetadataForUser(c, post, userID) + if appErr != nil { + mlog.Error("Failed to sanitize post metadata for user", mlog.String("user_id", userID), mlog.Err(appErr)) + + // If we failed to sanitize the post, we still want to remove the metadata. + sanitizedPost = post.Clone() + sanitizedPost.Metadata = nil + } + post = sanitizedPost + postJSON, jsonErr := post.ToJSON() if jsonErr != nil { mlog.Warn("Failed to encode post to JSON", mlog.Err(jsonErr))