From a9bcc48df7bc96f8428c312b77aff9c53740e36b Mon Sep 17 00:00:00 2001 From: sushi-killer <46325863+sushi-killer@users.noreply.github.com> Date: Sat, 17 Oct 2026 01:45:08 +0300 Subject: [PATCH 1/2] feat(web): join a live session from ?join= in the page URL --- apps/figcraft-web/src/main.rs | 9 ++++++++- apps/figcraft-web/src/query.rs | 10 ++++++++++ apps/figcraft-web/src/query_tests.rs | 21 +++++++++++++++++++++ apps/figcraft-web/src/web.rs | 8 +++++++- 4 files changed, 46 insertions(+), 2 deletions(-) create mode 100644 apps/figcraft-web/src/query.rs create mode 100644 apps/figcraft-web/src/query_tests.rs diff --git a/apps/figcraft-web/src/main.rs b/apps/figcraft-web/src/main.rs index 587fd60b8..35aebb02e 100644 --- a/apps/figcraft-web/src/main.rs +++ b/apps/figcraft-web/src/main.rs @@ -13,8 +13,15 @@ //! (browsers block `ws://` from secure pages); serve it over `http://` on a trusted network to //! join from other machines. //! -//! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU. +//! URL query: `?webgl` forces the WebGL2 backend instead of WebGPU; `?join=` joins that live session once the page has loaded, so a bookmark opens a shared file. +//! `join` takes the rest of the query: put it last. The link carries the session's secret, so the +//! URL (and the browser history) is as private as the link itself. +#[cfg(any(target_arch = "wasm32", test))] +mod query; +#[cfg(test)] +mod query_tests; #[cfg(target_arch = "wasm32")] mod web; diff --git a/apps/figcraft-web/src/query.rs b/apps/figcraft-web/src/query.rs new file mode 100644 index 000000000..be68f598b --- /dev/null +++ b/apps/figcraft-web/src/query.rs @@ -0,0 +1,10 @@ +//! The page's URL query: which flags it sets and the invite link it names. + +/// The invite link in `?join=` (`search` is `location.search`, with or without its `?`), still +/// escaped. `join` takes the rest of the query, so a pasted `figcraft://join?host=…&file=…&token=…` +/// keeps its own `&`s; put it last. +pub fn join_link(search: &str) -> Option<&str> { + let query = search.strip_prefix('?').unwrap_or(search); + let start = if query.starts_with("join=") { 0 } else { query.find("&join=")? + 1 }; + query.get(start + "join=".len()..).filter(|link| !link.is_empty()) +} diff --git a/apps/figcraft-web/src/query_tests.rs b/apps/figcraft-web/src/query_tests.rs new file mode 100644 index 000000000..9582682f2 --- /dev/null +++ b/apps/figcraft-web/src/query_tests.rs @@ -0,0 +1,21 @@ +//! `?join=` in the page's URL. + +use crate::query::join_link; + +#[test] +fn join_takes_the_rest_of_the_query() { + let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv"; + assert_eq!(join_link(&format!("?join={link}")), Some(link), "a pasted link keeps its own &s"); + assert_eq!(join_link(&format!("?webgl&join={link}")), Some(link), "after other flags"); + assert_eq!(join_link("?join=figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), Some("figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), "escaped, decoded later"); + assert_eq!(join_link("join=K7M-2QX-9TD"), Some("K7M-2QX-9TD"), "a join code, no leading ?"); +} + +#[test] +fn no_join_without_the_parameter() { + assert_eq!(join_link(""), None); + assert_eq!(join_link("?webgl"), None); + assert_eq!(join_link("?join="), None); + assert_eq!(join_link("?rejoin=x"), None, "only the whole parameter name"); + assert_eq!(join_link("?xjoin=x&a=1"), None); +} diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs index 8cadb0138..d3c164411 100644 --- a/apps/figcraft-web/src/web.rs +++ b/apps/figcraft-web/src/web.rs @@ -40,7 +40,13 @@ pub fn start() { // on the socket wakes the page for a frame. let ctx = cc.egui_ctx.clone(); session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint())))); - let fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() })); + let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() })); + // `?join=`: join that session, as opening an invite link does on the desktop. + let search = query(); + if let Some(link) = crate::query::join_link(&search) { + let link = js_sys::decode_uri_component(link).ok().and_then(|s| s.as_string()).unwrap_or_else(|| link.to_string()); + figcraft_ui_egui::live::open_invite(&mut fig, &link); + } Ok(Box::new(WebShell { fig })) }), ) From 02b231db6dd9457097017ddc30d96d8a947c724d Mon Sep 17 00:00:00 2001 From: bflatastic Date: Sat, 17 Oct 2026 16:18:50 +0700 Subject: [PATCH 2/2] #712: read the invite link from the URL fragment (#join=), never sent to the web host; ignore overlong links --- apps/figcraft-web/src/main.rs | 10 ++++++---- apps/figcraft-web/src/query.rs | 21 +++++++++++-------- apps/figcraft-web/src/query_tests.rs | 30 ++++++++++++++++++---------- apps/figcraft-web/src/web.rs | 6 +++--- 4 files changed, 41 insertions(+), 26 deletions(-) diff --git a/apps/figcraft-web/src/main.rs b/apps/figcraft-web/src/main.rs index 35aebb02e..7eed2ffb3 100644 --- a/apps/figcraft-web/src/main.rs +++ b/apps/figcraft-web/src/main.rs @@ -13,10 +13,12 @@ //! (browsers block `ws://` from secure pages); serve it over `http://` on a trusted network to //! join from other machines. //! -//! URL query: `?webgl` forces the WebGL2 backend instead of WebGPU; `?join=` joins that live session once the page has loaded, so a bookmark opens a shared file. -//! `join` takes the rest of the query: put it last. The link carries the session's secret, so the -//! URL (and the browser history) is as private as the link itself. +//! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU. +//! +//! URL fragment: `#join=` joins that live session once the page has +//! loaded, so a bookmark opens a shared file. `join` takes the rest of the fragment: put it last. +//! The link carries the session's secret; a fragment is never sent to the web host, but the address +//! bar and the browser history keep it, so the URL is as private as the link itself. #[cfg(any(target_arch = "wasm32", test))] mod query; diff --git a/apps/figcraft-web/src/query.rs b/apps/figcraft-web/src/query.rs index be68f598b..befeb36b7 100644 --- a/apps/figcraft-web/src/query.rs +++ b/apps/figcraft-web/src/query.rs @@ -1,10 +1,15 @@ -//! The page's URL query: which flags it sets and the invite link it names. +//! The page's URL: the invite link its fragment names. -/// The invite link in `?join=` (`search` is `location.search`, with or without its `?`), still -/// escaped. `join` takes the rest of the query, so a pasted `figcraft://join?host=…&file=…&token=…` -/// keeps its own `&`s; put it last. -pub fn join_link(search: &str) -> Option<&str> { - let query = search.strip_prefix('?').unwrap_or(search); - let start = if query.starts_with("join=") { 0 } else { query.find("&join=")? + 1 }; - query.get(start + "join=".len()..).filter(|link| !link.is_empty()) +/// The invite link in `#join=` (`fragment` is `location.hash`, with or without its `#`), still +/// escaped. The fragment, unlike the query, never leaves the browser, so the link's secret stays out +/// of the web host's logs and `Referer` headers. `join` takes the rest of the fragment, so a pasted +/// `figcraft://join?host=…&file=…&token=…` keeps its own `&`s. Anything longer than an escaped invite +/// link can be is ignored; what is left is checked by `collab.join` like a link the desktop app is +/// opened with. +pub fn join_link(fragment: &str) -> Option<&str> { + // An invite link is at most 2 KiB; every byte of it escaped is three. + const MAX: usize = 3 * 2048; + let fragment = fragment.strip_prefix('#').unwrap_or(fragment); + let start = if fragment.starts_with("join=") { 0 } else { fragment.find("&join=")? + 1 }; + fragment.get(start + "join=".len()..).filter(|link| !link.is_empty() && link.len() <= MAX) } diff --git a/apps/figcraft-web/src/query_tests.rs b/apps/figcraft-web/src/query_tests.rs index 9582682f2..261ebaeb6 100644 --- a/apps/figcraft-web/src/query_tests.rs +++ b/apps/figcraft-web/src/query_tests.rs @@ -1,21 +1,29 @@ -//! `?join=` in the page's URL. +//! `#join=` in the page's URL. use crate::query::join_link; #[test] -fn join_takes_the_rest_of_the_query() { +fn join_takes_the_rest_of_the_fragment() { let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv"; - assert_eq!(join_link(&format!("?join={link}")), Some(link), "a pasted link keeps its own &s"); - assert_eq!(join_link(&format!("?webgl&join={link}")), Some(link), "after other flags"); - assert_eq!(join_link("?join=figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), Some("figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), "escaped, decoded later"); - assert_eq!(join_link("join=K7M-2QX-9TD"), Some("K7M-2QX-9TD"), "a join code, no leading ?"); + assert_eq!(join_link(&format!("#join={link}")), Some(link), "a pasted link keeps its own &s"); + assert_eq!(join_link(&format!("#x=1&join={link}")), Some(link), "after other entries"); + assert_eq!(join_link("#join=figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), Some("figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), "escaped, decoded later"); + assert_eq!(join_link("join=K7M-2QX-9TD"), Some("K7M-2QX-9TD"), "a join code, no leading #"); } #[test] -fn no_join_without_the_parameter() { +fn no_join_without_the_entry() { assert_eq!(join_link(""), None); - assert_eq!(join_link("?webgl"), None); - assert_eq!(join_link("?join="), None); - assert_eq!(join_link("?rejoin=x"), None, "only the whole parameter name"); - assert_eq!(join_link("?xjoin=x&a=1"), None); + assert_eq!(join_link("#"), None); + assert_eq!(join_link("#join="), None); + assert_eq!(join_link("#rejoin=x"), None, "only the whole entry name"); + assert_eq!(join_link("#xjoin=x&a=1"), None); + assert_eq!(join_link("?join=x"), None, "the query isn't read: it goes to the web host"); +} + +#[test] +fn an_overlong_link_is_ignored() { + let long = format!("#join=figcraft://join?host=h&file=f&token={}", "a".repeat(7000)); + assert_eq!(join_link(&long), None); + assert_eq!(join_link(&format!("#join={}", "é".repeat(4000))), None, "length counts bytes"); } diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs index d3c164411..292136212 100644 --- a/apps/figcraft-web/src/web.rs +++ b/apps/figcraft-web/src/web.rs @@ -41,9 +41,9 @@ pub fn start() { let ctx = cc.egui_ctx.clone(); session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint())))); let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() })); - // `?join=`: join that session, as opening an invite link does on the desktop. - let search = query(); - if let Some(link) = crate::query::join_link(&search) { + // `#join=`: join that session, as opening an invite link does on the desktop. + let hash = web_sys::window().and_then(|w| w.location().hash().ok()).unwrap_or_default(); + if let Some(link) = crate::query::join_link(&hash) { let link = js_sys::decode_uri_component(link).ok().and_then(|s| s.as_string()).unwrap_or_else(|| link.to_string()); figcraft_ui_egui::live::open_invite(&mut fig, &link); }