ipfs / ipfs/ipfs-companion

Right-click upload from cookie/token-guarded services fail

Open
#351 0 comments 1 reaction 0 assignees View on GitHub
help wanted kind/bug P3 status/deferred
Dominant language
JavaScript
Stars
2.2k
Forks
338
Avg merge
3m
Merged PRs (30d)
1

Description

This one is nit-picky, but nevertheless, decreases UX:

## How to Reproduce

1. Go to a service that has some guarded content.
What I mean by that is if you copy URL to an image and paste it in "Incognito Mode" it will redirect you to login page. Lets use Slack as an example.
2. Upload image to a private channel
3. Right click on it and select "Upload to IPFS"

### Current Behaviour

Slack's login page is added to IPFS instead of selected image 🙃

### Desired Outcome

Selected image should be added to IPFS, as expected. 👌

**Rationale:**
It would not decrease website's security: if user was able to display image, she can save it to the disk and then upload it to IPFS manually anyway. :trollface:

## Potential Fix

My guess is that the bug is caused by `ipfs.util.addFromURL` doing internal `fetch` without proper credentials.
A fix would be to pass raw bytes/stream of right-clicked asset to one of `ipfs.files.add*` methods instead.

Contributor guide

Open the contributing guide

Research direction

Start by locating the right-click "Upload to IPFS" flow and its use of ipfs.util.addFromURL. Reproduce the Slack-style guarded-image case, then compare passing the selected asset as raw bytes or a stream to ipfs.files.add*; done means the image, not the login page, is added to IPFS.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.