mirrors/owncast
1
0
Fork 0
mirror of https://github.com/owncast/owncast.git synced 2024-11-22 04:40:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

Block Private URLs at serverurl API endpoint (#3295)

Browse source 
* Block Private URLs at `serverurl` API endpoint

* Block Private URLs at `serverurl` with `net/netip`
This commit is contained in:
Shreyas 2023-09-07 08:58:15 +05:30 committed by Gabe Kangas
parent 541b0981f0
commit 34cdce3f71
2 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
controllers/admin/config.go
View file

@ -5,6 +5,7 @@ import (
"fmt"
"net"
"net/http"
"net/netip"
"os"
"path/filepath"
"reflect"
@ -409,6 +410,14 @@ func SetServerURL(w http.ResponseWriter, r *http.Request) {
return
}
// Block Private IP URLs
ipAddr, ipErr := netip.ParseAddr(utils.GetHostnameWithoutPortFromURLString(rawValue))
if ipErr == nil && ipAddr.IsPrivate() {
controllers.WriteSimpleResponse(w, false, "Server URL cannot be private")
return
}
// Trim any trailing slash
serverURL := strings.TrimRight(rawValue, "/")

10
utils/utils.go
View file

@ -382,6 +382,16 @@ func GetHostnameFromURLString(s string) string {
return u.Host
}
// GetHostnameWithoutPortFromURLString will return the hostname component without the port from a URL object.
func GetHostnameWithoutPortFromURLString(s string) string {
u, err := url.Parse(s)
if err != nil {
return ""
}
return u.Hostname()
}
// GetHashtagsFromText returns all the #Hashtags from a string.
func GetHashtagsFromText(text string) []string {
re := regexp.MustCompile(`#[a-zA-Z0-9_]+`)