From f6e04daf6006ec8472e6b03a531da7ed57b2f3a2 Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Fri, 22 Dec 2023 09:05:43 +0800
Subject: [PATCH] return invalid url if feed url is different from user
 provided url

---
 packages/api/src/generated/graphql.ts             |  1 +
 packages/api/src/generated/schema.graphql         |  1 +
 packages/api/src/resolvers/subscriptions/index.ts | 14 ++++++++++++--
 packages/api/src/schema.ts                        |  1 +
 4 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/packages/api/src/generated/graphql.ts b/packages/api/src/generated/graphql.ts
index 62ba7be07..f2fa24d95 100644
--- a/packages/api/src/generated/graphql.ts
+++ b/packages/api/src/generated/graphql.ts
@@ -2790,6 +2790,7 @@ export enum SubscribeErrorCode {
   AlreadySubscribed = 'ALREADY_SUBSCRIBED',
   BadRequest = 'BAD_REQUEST',
   ExceededMaxSubscriptions = 'EXCEEDED_MAX_SUBSCRIPTIONS',
+  InvalidUrl = 'INVALID_URL',
   NotFound = 'NOT_FOUND',
   Unauthorized = 'UNAUTHORIZED'
 }
diff --git a/packages/api/src/generated/schema.graphql b/packages/api/src/generated/schema.graphql
index cbcdc1808..ac0db6c82 100644
--- a/packages/api/src/generated/schema.graphql
+++ b/packages/api/src/generated/schema.graphql
@@ -2190,6 +2190,7 @@ enum SubscribeErrorCode {
   ALREADY_SUBSCRIBED
   BAD_REQUEST
   EXCEEDED_MAX_SUBSCRIPTIONS
+  INVALID_URL
   NOT_FOUND
   UNAUTHORIZED
 }
diff --git a/packages/api/src/resolvers/subscriptions/index.ts b/packages/api/src/resolvers/subscriptions/index.ts
index 98dd23e3f..5ec3adc9f 100644
--- a/packages/api/src/resolvers/subscriptions/index.ts
+++ b/packages/api/src/resolvers/subscriptions/index.ts
@@ -1,6 +1,6 @@
 import axios from 'axios'
 import { parseHTML } from 'linkedom'
-import { Brackets } from 'typeorm'
+import { Brackets, In } from 'typeorm'
 import {
   DEFAULT_SUBSCRIPTION_FOLDER,
   Subscription,
@@ -204,7 +204,7 @@ export const subscribeResolver = authorized<
 
     // find existing subscription
     const existingSubscription = await getRepository(Subscription).findOneBy({
-      url: feedUrl,
+      url: In([feedUrl, input.url]), // check both user provided url and parsed url
       user: { id: uid },
       type: SubscriptionType.Rss,
     })
@@ -241,6 +241,16 @@ export const subscribeResolver = authorized<
       }
     }
 
+    if (feedUrl !== input.url) {
+      log.info('feed url is different from user provided url', {
+        feedUrl,
+        inputUrl: input.url,
+      })
+      return {
+        errorCodes: [SubscribeErrorCode.InvalidUrl],
+      }
+    }
+
     // create new rss subscription
     const MAX_RSS_SUBSCRIPTIONS = env.subscription.feed.max
 
diff --git a/packages/api/src/schema.ts b/packages/api/src/schema.ts
index 4df9a5b35..ac1fdd125 100755
--- a/packages/api/src/schema.ts
+++ b/packages/api/src/schema.ts
@@ -1737,6 +1737,7 @@ const schema = gql`
     NOT_FOUND
     ALREADY_SUBSCRIBED
     EXCEEDED_MAX_SUBSCRIPTIONS
+    INVALID_URL
   }
 
   union AddPopularReadResult = AddPopularReadSuccess | AddPopularReadError