xiaoxue_admin
/
RSSHub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(route): fediverse ssrf

This commit is contained in:
Tony 2024-06-28 21:35:48 +08:00
parent 944b0f441a
commit c331e9b127
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/routes/fediverse/timeline.ts
View File

@ -3,6 +3,8 @@ import { Route } from '@/types';
import { parseDate } from '@/utils/parse-date';
import ofetch from '@/utils/ofetch';
import { config } from '@/config';
import ConfigNotFoundError from '@/errors/types/config-not-found';
export const route: Route = {
path: '/timeline/:account',
@ -22,6 +24,8 @@ export const route: Route = {
handler,
};
const allowedDomain = new Set(['mastodon.social', 'pawoo.net', config.mastodon.apiHost].filter(Boolean));
async function handler(ctx) {
const account = ctx.req.param('account');
const domain = account.split('@')[1];
@ -30,6 +34,9 @@ async function handler(ctx) {
if (!domain || !username) {
throw new InvalidParameterError('Invalid account');
}
if (!config.feature.allow_user_supply_unsafe_domain && !allowedDomain.has(domain.toLowerCase())) {
throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
}
const requestOptions = {
headers: {