From c331e9b1273005de581aa7b0581df039475f7c41 Mon Sep 17 00:00:00 2001
From: Tony <TonyRL@users.noreply.github.com>
Date: Fri, 28 Jun 2024 21:35:48 +0800
Subject: [PATCH] fix(route): fediverse ssrf

---
 lib/routes/fediverse/timeline.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/routes/fediverse/timeline.ts b/lib/routes/fediverse/timeline.ts
index dfc13c6b3..da4dc9642 100644
--- a/lib/routes/fediverse/timeline.ts
+++ b/lib/routes/fediverse/timeline.ts
@@ -3,6 +3,8 @@ import { Route } from '@/types';
 
 import { parseDate } from '@/utils/parse-date';
 import ofetch from '@/utils/ofetch';
+import { config } from '@/config';
+import ConfigNotFoundError from '@/errors/types/config-not-found';
 
 export const route: Route = {
     path: '/timeline/:account',
@@ -22,6 +24,8 @@ export const route: Route = {
     handler,
 };
 
+const allowedDomain = new Set(['mastodon.social', 'pawoo.net', config.mastodon.apiHost].filter(Boolean));
+
 async function handler(ctx) {
     const account = ctx.req.param('account');
     const domain = account.split('@')[1];
@@ -30,6 +34,9 @@ async function handler(ctx) {
     if (!domain || !username) {
         throw new InvalidParameterError('Invalid account');
     }
+    if (!config.feature.allow_user_supply_unsafe_domain && !allowedDomain.has(domain.toLowerCase())) {
+        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
 
     const requestOptions = {
         headers: {