prehistoric-systems/omnivore
1
0
Fork 0
mirror of https://github.com/omnivore-app/omnivore.git synced 2026-03-11 08:54:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #200 from omnivore-app/fix/validate-urls

Browse source 
Use the validateUrl method to validate URLs
This commit is contained in:
Jackson Harper 2022-03-08 20:28:33 -08:00 committed by GitHub
commit 384a0771a7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
packages/api/src/services/create_page_save_request.ts
View file

@ -12,7 +12,7 @@ import * as privateIpLib from 'private-ip'
const isPrivateIP = privateIpLib.default
export const validateUrl = (url: string) => {
export const validateUrl = (url: string): URL => {
const u = new URL(url)
// Make sure the URL is http or https
if (u.protocol !== 'http:' && u.protocol !== 'https:') {
@ -36,6 +36,7 @@ export const validateUrl = (url: string) => {
if (isPrivateIP(u.hostname)) {
throw new Error('Invalid URL')
}
return u
}
export const createPageSaveRequest = async (
@ -46,26 +47,7 @@ export const createPageSaveRequest = async (
articleSavingRequestId = uuidv4()
): Promise<ArticleSavingRequest> => {
try {
const u = new URL(url)
// Make sure the URL is http or https
if (u.protocol !== 'http:' && u.protocol !== 'https:') {
throw new Error('Invalid URL')
}
// Make sure the domain is not localhost
if (u.hostname === 'localhost' || u.hostname === '0.0.0.0') {
throw new Error('Invalid URL')
}
// Make sure its not a private GCP domain
if (
u.hostname == 'metadata.google.internal' ||
/^169.254.*/.test(u.hostname)
) {
throw new Error('Invalid URL')
}
// Make sure the domain is not a private IP
if (/^(10|172\.16|192\.168)\..*/.test(u.hostname)) {
throw new Error('Invalid URL')
}
validateUrl(url)
} catch (error) {
console.log('invalid url', url, error)
return Promise.reject({