HoovesSocial/hippofish
2
0
Fork 0
Code Issues 3 Pull requests 1 Projects Releases Packages Wiki Activity Actions

security: validate image url (#9882)

Browse source 
It looks like url validations are added in f7564d87b0, but I found another validation commit not applied in Calckey, so I cherry-picked 0da0cc80b9 from [Misskey](https://github.com/misskey-dev/misskey).

Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>
Co-authored-by: naskya <m@naskya.net>
Reviewed-on: https://codeberg.org/calckey/calckey/pulls/9882
Co-authored-by: naskya <naskya@noreply.codeberg.org>
Co-committed-by: naskya <naskya@noreply.codeberg.org>
This commit is contained in:
naskya 2023-04-21 01:50:47 +00:00 committed by Kainoa Kanter
parent e0d76ef8ef
commit 00b45ad726
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
packages/backend/src/remote/activitypub/models/image.ts
View file

@ -29,6 +29,10 @@ export async function createImage(
throw new Error("invalid image: url not privided"); throw new Error("invalid image: url not privided");
} }
if (!image.url.startsWith("https://") && !image.url.startsWith("http://")) {
throw new Error("invalid image: unexpected shcema of url: " + image.url);
}
logger.info(`Creating the Image: ${image.url}`); logger.info(`Creating the Image: ${image.url}`);
const instance = await fetchMeta(); const instance = await fetchMeta();