tommy/mobilizon
1
0
Fork 0
forked from potsda.mn/mobilizon
Code Pull requests Activity

Validate URIs before trying to proxify them

Browse source 
Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel 2021-03-24 11:17:24 +01:00
parent 7b9910f251
commit 98a219c7a9
No known key found for this signature in database
GPG key ID: A061B9DDE0CA0773
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
lib/web/proxy/reverse_proxy.ex
View file

@ -120,7 +120,8 @@ defmodule Mobilizon.Web.ReverseProxy do
opts
end
with {:ok, code, headers, client} <- request(method, url, req_headers, hackney_opts),
with {:is_url, true} <- {:is_url, valid_uri?(url)},
{:ok, code, headers, client} <- request(method, url, req_headers, hackney_opts),
:ok <- header_length_constraint(headers, Keyword.get(opts, :max_body_length)) do
response(conn, client, url, code, headers, opts)
else
@ -129,6 +130,13 @@ defmodule Mobilizon.Web.ReverseProxy do
|> head_response(url, code, headers, opts)
|> halt()
{:is_url, false} ->
Logger.warn("Tried to reverse proxy URL #{inspect(url)}")
conn
|> error_or_redirect(url, 500, "Request failed", opts)
|> halt()
{:error, {:invalid_http_response, code}} ->
Logger.error("#{__MODULE__}: request to #{inspect(url)} failed with HTTP status #{code}")
@ -397,4 +405,10 @@ defmodule Mobilizon.Web.ReverseProxy do
def filename(url_or_path) do
if path = URI.parse(url_or_path).path, do: Path.basename(path)
end
@spec valid_uri?(String.t()) :: boolean()
defp valid_uri?(url) do
uri = URI.parse(url)
uri.scheme != nil && uri.host =~ "."
end
end