chore: drop old client support (#14369)

packages/frontend/apps/electron/src/main/ui/handlers.ts

@@ -6,6 +6,7 @@ import { isMacOS } from '../../shared/utils';
 import { persistentConfig } from '../config-storage/persist';
 import { logger } from '../logger';
 import { openExternalSafely } from '../security/open-external';
+import { resolveAndValidateUrlForPreview } from '../security/url-safety';
 import type { WorkbenchViewMeta } from '../shared-state-schema';
 import { MenubarStateKey, MenubarStateSchema } from '../shared-state-schema';
 import { globalStateStorage } from '../shared-storage/storage';
@@ -37,6 +38,13 @@ import { getOrCreateCustomThemeWindow } from '../windows-manager/custom-theme-wi
 import { getChallengeResponse } from './challenge';
 import { uiSubjects } from './subject';
 
+const EMPTY_OBJECT = Object.freeze({
+  title: undefined,
+  description: undefined,
+  icon: undefined,
+  image: undefined,
+});
+
 const TraySettingsState = {
   $: globalStateStorage.watch<MenubarStateSchema>(MenubarStateKey).pipe(
     map(v => MenubarStateSchema.parse(v ?? {})),
@@ -127,6 +135,13 @@ export const uiHandlers = {
     }
   },
   getBookmarkDataByLink: async (_, link: string) => {
+    try {
+      // Basic validation up-front to prevent SSRF (including redirects).
+      await resolveAndValidateUrlForPreview(link);
+    } catch {
+      return EMPTY_OBJECT;
+    }
+
     if (
       (link.startsWith('https://x.com/') ||
         link.startsWith('https://www.x.com/') ||
@@ -135,8 +150,9 @@ export const uiHandlers = {
       link.includes('/status/')
     ) {
       // use api.fxtwitter.com
-      link =
-        'https://api.fxtwitter.com/status/' + /\/status\/(.*)/.exec(link)?.[1];
+      const statusId = /\/status\/(\d+)/.exec(link)?.[1];
+      if (!statusId) return EMPTY_OBJECT;
+      link = `https://api.fxtwitter.com/status/${statusId}`;
       try {
         const { tweet } = (await fetch(link).then(res => res.json())) as any;
         return {
@@ -161,7 +177,20 @@ export const uiHandlers = {
           'User-Agent':
             'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36',
         },
-        followRedirects: 'follow',
+        followRedirects: 'manual',
+        handleRedirects: (_baseUrl: string, forwardedUrl: string) => {
+          try {
+            // Only allow http(s) redirects and re-validate before following.
+            const u = new URL(forwardedUrl);
+            return u.protocol === 'http:' || u.protocol === 'https:';
+          } catch {
+            return false;
+          }
+        },
+        resolveDNSHost: async (url: string) => {
+          const { address } = await resolveAndValidateUrlForPreview(url);
+          return address;
+        },
       }).catch(() => {
         return {
           title: '',