xiaoxue_admin
/
RSSHub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: ssrf

This commit is contained in:
DIYgod 2024-03-04 03:48:06 +08:00
parent 7054e42012
commit 64f3b9229b
No known key found for this signature in database
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/routes/mastodon/acct.ts
View File

@ -1,9 +1,14 @@
// @ts-nocheck
const utils = require('./utils');
import { config } from '@/config';
export default async (ctx) => {
const acct = ctx.req.param('acct');
const only_media = ctx.req.param('only_media') ? 'true' : 'false';
const acctSite = acct.split('@').filter(Boolean)[1];
if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(acctSite)) {
throw new Error(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
}
const { site, account_id } = await utils.getAccountIdByAcct(acct);

5
lib/routes/zjol/paper.ts
View File

@ -8,6 +8,11 @@ export default async (ctx) => {
const id = ctx.req.param('id') ?? 'zjrb';
const limit = ctx.req.query('limit') ? Number.parseInt(ctx.req.query('limit')) : 100;
const allowedId = ['zjrb', 'qjwb', 'msb', 'zjlnb', 'zjfzb', 'jnyb'];
if (!allowedId.includes(id)) {
throw new Error('id not allowed');
}
const query = id === 'jnyb' ? 'map[name="PagePicMap"] area' : 'ul.main-ed-articlenav-list li a';
const rootUrl = id === 'qjwb' ? 'http://qjwb.thehour.cn' : `https://${id}.zjol.com.cn`;