fix(feed): hide sensitive media previews

lib/pleroma/web/feed/feed_view.ex

@@ -117,10 +117,14 @@ defmodule Pleroma.Web.Feed.FeedView do
       end
 
     attachments_html =
-      (data["attachment"] || [])
-      |> Enum.map(&rss_attachment_preview/1)
-      |> Enum.reject(&(&1 == ""))
-      |> Enum.join("<br/><br/>")
+      if data["sensitive"] do
+        ""
+      else
+        (data["attachment"] || [])
+        |> Enum.map(&rss_attachment_preview/1)
+        |> Enum.reject(&(&1 == ""))
+        |> Enum.join("<br/><br/>")
+      end
 
     [base_content, attachments_html]
     |> Enum.reject(&(&1 == ""))
@@ -223,7 +227,9 @@ defmodule Pleroma.Web.Feed.FeedView do
     attachment["name"] || ""
   end
 
-  def media_content_xml(attachment) do
+  def media_content_xml(_attachment, true), do: ""
+
+  def media_content_xml(attachment, _sensitive) do
     href = escape(attachment_href(attachment) || "")
     type = escape(attachment_type(attachment) || "application/octet-stream")
     medium = escape(attachment_medium(attachment))
@@ -234,20 +240,17 @@ defmodule Pleroma.Web.Feed.FeedView do
         _ -> ""
       end
 
-    description_xml =
-      case attachment_description(attachment) do
-        "" ->
-          ""
+    case attachment_description(attachment) do
+      "" ->
+        ~s(<media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}"/>\n)
 
-        description ->
-          ~s(\n  <media:description type="plain">#{escape(description)}</media:description>)
-      end
-
-    """
-    <media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}">
-      <media:rating scheme="urn:simple">nonadult</media:rating>#{description_xml}
-    </media:content>
-    """
+      description ->
+        """
+        <media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}">
+          <media:description type="plain">#{escape(description)}</media:description>
+        </media:content>
+        """
+    end
   end
 
   defp attachment_url_data(attachment) do

lib/pleroma/web/templates/feed/feed/_activity.rss.eex

@@ -23,7 +23,7 @@
     <%= unless attachment_previewable?(attachment) do %>
       <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>" />
     <% end %>
-    <%= media_content_xml(attachment) %>
+    <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 
   <%= if @data["inReplyTo"] do %>

lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex

@@ -11,7 +11,7 @@
     <%= unless attachment_previewable?(attachment) do %>
       <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>"/>
     <% end %>
-    <%= media_content_xml(attachment) %>
+    <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>

test/pleroma/web/feed/feed_view_test.exs

@@ -19,4 +19,28 @@ defmodule Pleroma.Web.Feed.FeedViewTest do
     assert FeedView.atom_content_encoded(data) == expected
     assert FeedView.rss_content_encoded(data) == expected
   end
+
+  test "does not preview or classify sensitive attachments" do
+    attachment = %{
+      "name" => "spoiler",
+      "url" => [%{"href" => "https://example.com/spoiler.png", "mediaType" => "image/png"}]
+    }
+
+    data = %{
+      "attachment" => [attachment],
+      "content" => "content warning",
+      "sensitive" => true
+    }
+
+    assert FeedView.atom_content_encoded(data) == "content warning"
+    assert FeedView.rss_content_encoded(data) == "content warning"
+    assert FeedView.media_content_xml(attachment, true) == ""
+
+    media_content = FeedView.media_content_xml(attachment, false)
+    assert media_content =~ "<media:description type=\"plain\">spoiler</media:description>"
+    refute media_content =~ "media:rating"
+
+    assert FeedView.media_content_xml(Map.delete(attachment, "name"), false) ==
+             ~s(<media:content url="https://example.com/spoiler.png" type="image/png" medium="image"/>\n)
+  end
 end