Show the pictures inside Reddit comments

A comment that was a picture rendered as either a link or, for a Giphy, the
literal text `![gif](giphy|Ve7wX45gaOFmw8eeEM)`. On r/aww that is most of the
thread.

Reddit writes an inline image as a token rather than an address, in three
shapes: `![gif](giphy|ID)` for a Giphy, `![img](emote|t5_2th52|4358)` for a
subreddit emote, and `![img](jo8gf0ca92zd1)` for an image uploaded straight to
the comment. The useful part is that all three tokens are keys in that same
comment's own `media_metadata`, so this is one lookup and not three special
cases. Nothing in the adapter has to know what Giphy is.

The fourth shape is someone pasting the address of a picture, which on Reddit
is how most images in comments actually arrive -- 117 of them against 21
Giphys in the sample I scanned. Those are shown as pictures too, decided by
the file extension. A link that is not to an image stays a link.

Animated ones take `s.gif` over `s.mp4` even though the MP4 is several times
smaller: a GIF moves on its own in an `<img>`, and an MP4 would need a player
element with autoplay, loop and muted set, for something the size of a
postage stamp.

Everything goes through the `/m/` proxy, like all other media. Without that a
comment thread would have the reader's browser fetch dozens of files straight
from Reddit, which is the one thing this whole app exists to avoid.

Placing the image is the renderer's job, not the Markdown parser's, because
the proxy is a render-time concern and markdown.ts knows nothing about it --
so it takes an optional `ImageRenderer` and, without one, an image stays a
link exactly as before. The parser also learned `![...]` proper: the link rule
was matching from the `[` and stranding the `!` as text.

Verified on r/aww/comments/171dxph, which carries one Giphy and 77 pasted
images: 35 render on the first page, all 35 load, all 35 through the proxy,
no upstream address reaches the page, no token is left unresolved, and
nothing overflows the column or scrolls the page sideways.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_017nMQ2eDKnqALYhAibpTKTu

test/markdown.test.ts

@@ -1,9 +1,16 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { escapeHtml } from '../src/render/html.ts';
 import { renderMarkdown } from '../src/render/markdown.ts';
 
 const md = (text: string): string => String(renderMarkdown(text));
 
+/** Stands in for the real one, which proxies. Escapes the way that one does:
+ *  placing the image is the renderer's job, and so is making it safe. */
+const img = (url: string, alt: string): string =>
+  `<img src="${escapeHtml(url)}" alt="${escapeHtml(alt)}">`;
+const mdi = (text: string): string => String(renderMarkdown(text, img));
+
 test('markup a commenter typed is text, not markup', () => {
   const out = md('<script>alert(1)</script> & "quoted"');
   assert.ok(!out.includes('<script>'));
@@ -64,3 +71,54 @@ test('a single newline inside a paragraph is a line break, a blank line is a new
   assert.equal(md('one\ntwo'), '<p>one<br>two</p>');
   assert.equal(md('one\n\ntwo'), '<p>one</p><p>two</p>');
 });
+
+test('an image is a picture when there is something to place it with', () => {
+  assert.equal(mdi('![a cat](https://i.redd.it/x.jpg)'),
+    '<p><img src="https://i.redd.it/x.jpg" alt="a cat"></p>');
+});
+
+test('an image degrades to a link when there is not', () => {
+  const out = md('![a cat](https://i.redd.it/x.jpg)');
+  assert.ok(out.includes('<a href="https://i.redd.it/x.jpg"'));
+  assert.ok(!out.includes('<img'));
+});
+
+test("an image's `!` is not left behind as text", () => {
+  // The link rule would otherwise match from the `[` and strand the bang.
+  assert.ok(!mdi('![](https://i.redd.it/x.png)').includes('!'));
+});
+
+test('a pasted image address becomes the picture, not a link to it', () => {
+  // Which is how most images in a Reddit comment arrive.
+  const out = mdi('look\n\nhttps://preview.redd.it/abc.jpeg?width=1274&s=deadbeef');
+  assert.ok(out.includes('<img src="https://preview.redd.it/abc.jpeg?width=1274&amp;s=deadbeef"'));
+  assert.ok(!out.includes('<a href'));
+});
+
+test('a link that is not an image is still a link', () => {
+  const out = mdi('see https://example.com/article');
+  assert.ok(out.includes('<a href="https://example.com/article"'));
+  assert.ok(!out.includes('<img'));
+});
+
+test('a sentence after a pasted image keeps its punctuation out of the address', () => {
+  const out = mdi('here https://i.redd.it/x.jpg.');
+  assert.ok(out.includes('src="https://i.redd.it/x.jpg"'), out);
+  assert.ok(out.endsWith('.</p>'), out);
+});
+
+test('only http and https become pictures', () => {
+  const out = mdi('![x](javascript:alert(1))');
+  assert.ok(!out.includes('<img'));
+  assert.ok(out.includes('![x]'));
+});
+
+test("an image's alt text is escaped like anything else a stranger wrote", () => {
+  const out = mdi('![" onerror=alert(1)](https://i.redd.it/x.jpg)');
+  assert.ok(!out.includes('onerror=alert(1)>'), out);
+  assert.ok(out.includes('&quot;'));
+});
+
+test('images inside a quote are still placed', () => {
+  assert.match(mdi('> ![](https://i.redd.it/x.gif)'), /<blockquote><p><img/);
+});

test/reddit.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { commentsFrom, mediaFromLink, toPost, treeFromDepths } from '../src/platforms/reddit.ts';
+import { commentsFrom, mediaFromLink, resolveInlineImages, toPost, treeFromDepths } from '../src/platforms/reddit.ts';
 import { reddit } from '../src/platforms/reddit.ts';
 import { originalUrlFor } from '../src/platforms/index.ts';
 import { fixture } from './helpers.ts';
@@ -168,3 +168,82 @@ test('the page fallback rebuilds nesting from the depth on each comment', () =>
 test('a comment the page gave no text for is dropped rather than shown empty', () => {
   assert.deepEqual(treeFromDepths([{ depth: 0, author: 'a', score: 1, created: '', text: '' }]), []);
 });
+
+// Real shapes, captured from comments carrying each kind.
+const GIPHY = {
+  'giphy|Ve7wX45gaOFmw8eeEM': {
+    status: 'valid',
+    e: 'AnimatedImage',
+    m: 'image/gif',
+    s: {
+      y: 200,
+      x: 304,
+      gif: 'https://external-preview.redd.it/CTp8.gif?width=304&height=200&s=b0e9',
+      mp4: 'https://external-preview.redd.it/CTp8.gif?width=304&height=200&format=mp4&s=a389',
+    },
+  },
+};
+
+const UPLOAD = {
+  jo8gf0ca92zd1: {
+    status: 'valid',
+    e: 'Image',
+    m: 'image/jpeg',
+    s: { y: 1270, x: 1274, u: 'https://preview.redd.it/jo8gf0ca92zd1.jpeg?width=1274&s=c226' },
+  },
+};
+
+test('a giphy comment points at the gif rather than at a token', () => {
+  // `![gif](giphy|ID)` is not an address, and renders as nothing at all until
+  // it is looked up in the comment's own media_metadata.
+  assert.equal(
+    resolveInlineImages('![gif](giphy|Ve7wX45gaOFmw8eeEM)', GIPHY),
+    '![gif](https://external-preview.redd.it/CTp8.gif?width=304&height=200&s=b0e9)',
+  );
+});
+
+test('the animated form takes the gif, which plays on its own', () => {
+  const out = resolveInlineImages('![gif](giphy|Ve7wX45gaOFmw8eeEM)', GIPHY);
+  assert.ok(out.includes('.gif?'), out);
+  assert.ok(!out.includes('format=mp4'), 'an mp4 would need a player to move');
+});
+
+test('an uploaded image resolves through the same lookup', () => {
+  // Giphy, emotes and uploads are all a token that is a key in the same map,
+  // so none of them needs naming.
+  assert.equal(
+    resolveInlineImages('![img](jo8gf0ca92zd1)', UPLOAD),
+    '![img](https://preview.redd.it/jo8gf0ca92zd1.jpeg?width=1274&s=c226)',
+  );
+});
+
+test('a target that is already an address is left alone', () => {
+  const already = '![a](https://i.redd.it/x.jpg)';
+  assert.equal(resolveInlineImages(already, UPLOAD), already);
+  assert.equal(resolveInlineImages(already, undefined), already);
+});
+
+test('a token with no entry, or a broken one, is not invented', () => {
+  assert.equal(resolveInlineImages('![gif](giphy|missing)', GIPHY), '![gif](giphy|missing)');
+  assert.equal(
+    resolveInlineImages('![img](gone)', { gone: { status: 'failed', e: 'Image' } }),
+    '![img](gone)',
+  );
+});
+
+test('inline images survive the walk into the comment tree', () => {
+  const { comments } = commentsFrom({
+    data: {
+      children: [{
+        kind: 't1',
+        data: {
+          author: 'a',
+          body: 'ha ![gif](giphy|Ve7wX45gaOFmw8eeEM)',
+          media_metadata: GIPHY,
+          replies: '',
+        },
+      }],
+    },
+  });
+  assert.match(comments[0]?.text ?? '', /external-preview\.redd\.it/);
+});

test/render.test.ts

@@ -237,3 +237,21 @@ test('markup in a quoted post is escaped like any other stranger\'s text', () =>
   assert.ok(!html_.includes('<script>alert(1)</script>'));
   assert.ok(!html_.includes('<img src=x'));
 });
+
+test('a picture in a comment is proxied, and its alt text cannot break out', () => {
+  const page = renderPost(redditPost({
+    comments: [{
+      author: 'u/a',
+      text: '![" onerror=alert(1) x="](https://preview.redd.it/x.jpeg?s=abc)\n\nhttps://i.redd.it/y.png',
+      replies: [],
+    }],
+  }));
+
+  assert.ok(!page.includes('https://preview.redd.it/x.jpeg'), 'upstream URLs must not reach the page');
+  assert.ok(!page.includes('https://i.redd.it/y.png'), 'a pasted address is proxied too');
+  assert.equal((page.match(/<img class="c__img" src="\/m\//g) ?? []).length, 2);
+  // The payload survives as text inside the attribute, which is the point:
+  // its quotes are neutered, so it cannot close `alt="` and become markup.
+  assert.ok(page.includes('alt="&quot; onerror=alert(1) x=&quot;"'), 'alt text must be escaped');
+  assert.ok(!/alt="" onerror/.test(page), 'the attribute must not be closable');
+});