diff --git a/packages/api/src/services/create_page_save_request.ts b/packages/api/src/services/create_page_save_request.ts index 1e417bab7..0120155bf 100644 --- a/packages/api/src/services/create_page_save_request.ts +++ b/packages/api/src/services/create_page_save_request.ts @@ -12,7 +12,7 @@ import * as privateIpLib from 'private-ip' const isPrivateIP = privateIpLib.default -export const validateUrl = (url: string) => { +export const validateUrl = (url: string): URL => { const u = new URL(url) // Make sure the URL is http or https if (u.protocol !== 'http:' && u.protocol !== 'https:') { @@ -36,6 +36,7 @@ export const validateUrl = (url: string) => { if (isPrivateIP(u.hostname)) { throw new Error('Invalid URL') } + return u } export const createPageSaveRequest = async ( @@ -46,26 +47,7 @@ export const createPageSaveRequest = async ( articleSavingRequestId = uuidv4() ): Promise => { try { - const u = new URL(url) - // Make sure the URL is http or https - if (u.protocol !== 'http:' && u.protocol !== 'https:') { - throw new Error('Invalid URL') - } - // Make sure the domain is not localhost - if (u.hostname === 'localhost' || u.hostname === '0.0.0.0') { - throw new Error('Invalid URL') - } - // Make sure its not a private GCP domain - if ( - u.hostname == 'metadata.google.internal' || - /^169.254.*/.test(u.hostname) - ) { - throw new Error('Invalid URL') - } - // Make sure the domain is not a private IP - if (/^(10|172\.16|192\.168)\..*/.test(u.hostname)) { - throw new Error('Invalid URL') - } + validateUrl(url) } catch (error) { console.log('invalid url', url, error) return Promise.reject({