golang/owncast
1
0
Fork 0
mirror of https://github.com/owncast/owncast.git synced 2025-11-03 04:27:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

Block Private URLs at serverurl API endpoint (#3295)

Browse Source 
* Block Private URLs at `serverurl` API endpoint

* Block Private URLs at `serverurl` with `net/netip`
This commit is contained in:
Shreyas
2023-09-07 08:58:15 +05:30
committed by GitHub
parent 50c4c1a5c7
commit 062de79920
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
controllers/admin/config.go
View File

@ -5,6 +5,7 @@ import (
"fmt"
"net"
"net/http"
"net/netip"
"os"
"path/filepath"
"reflect"
@ -406,6 +407,14 @@ func SetServerURL(w http.ResponseWriter, r *http.Request) {
return
}
// Block Private IP URLs
ipAddr, ipErr := netip.ParseAddr(utils.GetHostnameWithoutPortFromURLString(rawValue))
if ipErr == nil && ipAddr.IsPrivate() {
controllers.WriteSimpleResponse(w, false, "Server URL cannot be private")
return
}
// Trim any trailing slash
serverURL := strings.TrimRight(rawValue, "/")