# Hand other people's apps only Discord avatar addresses · dara/icarus

[View on GitCafe](https://git.cafe/dara/icarus/commit/3d93f8fac6b9931bbaab3631dfea067df59bcb36)

Repository: [dara/icarus](https://git.cafe/dara/icarus)

Visibility: public

Requested revision: 3d93f8fac6b9931bbaab3631dfea067df59bcb36

Requested commit: 3d93f8fac6b9931bbaab3631dfea067df59bcb36

Commit: 3d93f8fac6b9931bbaab3631dfea067df59bcb36

Tree: f0e6a60607227fdd24d659291c17e0d643ac221c

Author: Dara Adedeji

Committer: Dara Adedeji

## Message

```
Hand other people's apps only Discord avatar addresses

A member's avatar comes from their Supabase user_metadata, which they can
edit, and every teammate's app fetches it with no click: in the presence
row and in the owner's share dialog. Any address there let one member make
the others' apps request a URL of their choosing, revealing their IP or
poking hosts on their network.

The server now passes on an avatar only when it is the kind Supabase writes
for a Discord sign-in (https://cdn.discordapp.com/avatars/... or
/embed/avatars/...): in profileFromIdentity, so in new presence passes and
users rows, and when presence and shares.listMembers read a stored avatar,
so rows written before need no backfill. Anything else goes as null, which
every build already draws as the initial-letter fallback.

```

## Parents

- [c2ddf79d7f5d83519e098e151021acdf34a9c04b](https://git.cafe/dara/icarus/commit/c2ddf79d7f5d83519e098e151021acdf34a9c04b?format=markdown)

[Source at this commit](https://git.cafe/dara/icarus/tree/3d93f8fac6b9931bbaab3631dfea067df59bcb36?format=markdown)