LLL External Image Source Review / 外部画像の参照元点検

What counts as an external image? An image block or gallery item whose stored image address (asset.url) is an absolute http:// or https:// URL, or a scheme-relative //host/... address. The panel shows only the host (with a non-default port), how many images use it, how many of those are http:// and how many are scheme-relative, and the block positions. Paths, query strings and credentials in the address are never shown.

What is not counted? Images from the EmDash media library (their stored address is a storage key, an internal /_emdash/api/media/file/... path or empty, with a media id), and media managed by an external media provider (reported only as a count). data: and blob: addresses and addresses that cannot be parsed are counted separately and never listed as hosts.

What is not read? Alt text and captions, the featured-image field, image links, embeds and iframes, text links, and the public page HTML. Columns, cover, HTML and unknown plugin blocks are not read; if any exist the report says it is partial. Use the image alt, featured image, embed provider and link plugins for those.

Does it check that the image still loads? No. Nothing is fetched, so availability, licence and file size are unknown. A listed host can be your own site or CDN; decide by host.

Limits. Field JSON 128 KiB, 2000 blocks, 2000 image items, 200 hosts, report 48 KiB. Exceeding a limit rejects the whole result with one fixed message.

Read capabilities only: content:read, schema:read, and content:revisions:read (only to read the current saved draft revision; revision history is not listed). One POST route requiring the host permission content:edit_own_drafts and a signed-in caller; host ownership checks apply. No writes, KV, storage, external HTTP (allowedHosts is empty), cron, hooks or API keys; image URLs are parsed as text and never requested. Results exist only for the request; nothing is stored. The panel and the copied report show hosts and counts only: no paths, query strings, credentials or article text. The report is tab-separated plain text; a cell that begins with =, +, - or @ gets a leading apostrophe so a spreadsheet does not run it as a formula. Failures return one fixed message with no internal details. Report vulnerabilities to contact@lx3.cafe without secrets.

読取3権限のみ。本文変更・保存・外部通信はありません（画像URLは文字として解析するだけで、取得しません）。表示とレポートはホストと件数のみで、パス・クエリ・認証情報・本文は出しません。脆弱性は contact@lx3.cafe へ、秘密を含めず連絡してください。

0.1.0

Adds a review panel for one saved Portable Text field: the hosts and counts of image URLs stored as absolute URLs in top-level image blocks and gallery items. Nothing is fetched.

Install LLL External Image Source Review (external-image-source-review) as a sandboxed plugin on EmDash 1.4.0 or later (below 2) with a configured supported sandbox runner. Open a saved article, choose the "External Image Source Review / 外部画像の参照元点検" editor panel, pick one Portable Text field and a language, then review. Edit, save, and review again. Select the whole plain report and press Cmd/Ctrl+C to copy. No automatic change or download.

What is read: the saved draft revision (or the published body); never text typed but not yet saved, and never the public page HTML. Free; no keys.

保存記事の編集画面でパネルを開き、本文項目と言語を選んで点検します。修正したら保存して再点検し、レポート全文を手動コピーします。未保存の入力・公開ページのHTMLは対象外。無料で完結します。