Merge commit from fork

232cf6d8255e772a55f64d965c6beb85cfbe931d

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: 734ef7d939b2159456defceff348273ee4eb85c2

src/endpoints/assets.js+33 -21 Viewed

 import fetch from 'node-fetch';
 import { UNSAFE_EXTENSIONS } from '../constants.js';
 import { clientRelativePath, isValidUrl } from '../util.js';
 +import { getHostFromUrl, isHostWhitelisted } from './content-manager.js';
 const VALID_CATEGORIES = ['bgm', 'ambient', 'blip', 'live2d', 'vrm', 'character', 'temp'];

  * @returns {void}
  */
 router.post('/download', async (request, response) => {
 -    const url = request.body.url;
 +    try {
 -    const inputCategory = request.body.category;
 +        if (!isValidUrl(request.body.url)) {
 +            console.warn('Asset download failed: Must be a valid URL');
 +            return response.sendStatus(400);
 +        }
 -    // Check category
 +        const url = String(request.body.url);
 -    let category = null;
 +        const inputCategory = request.body.category;
 -    for (let i of VALID_CATEGORIES)
 -        if (i == inputCategory)
 -            category = i;
 -    if (category === null) {
 +        const host = getHostFromUrl(url);
 -        console.error('Bad request: unsupported asset category.');
 +        if (!isHostWhitelisted(host)) {
 -        return response.sendStatus(400);
 +            console.error(`Received an import for "${host}", but site is not whitelisted. This domain must be added to the config key "whitelistImportDomains" to allow import from this source.`);
 -    }
 +            return response.sendStatus(404);
 +        }
             // ValidateCheck filenamecategory
 -    ensureFoldersExist(request.user.directories);
 +        let category = null;
 -    const validation = validateAssetFileName(request.body.filename);
 +        for (let i of VALID_CATEGORIES)
 -    if (validation.error)
 +            if (i == inputCategory)
 -        return response.status(400).send(validation.message);
 +                category = i;
 -    const temp_path = path.join(request.user.directories.assets, 'temp', request.body.filename);
 +        if (category === null) {
 -    const file_path = path.join(request.user.directories.assets, category, request.body.filename);
 +            console.error('Bad request: unsupported asset category.');
 -    console.info('Request received to download', url, 'to', file_path);
 +            return response.sendStatus(400);
 +        }
++
 +        // Validate filename
 +        ensureFoldersExist(request.user.directories);
 +        const validation = validateAssetFileName(request.body.filename);
 +        if (validation.error)
 +            return response.status(400).send(validation.message);
++
 +        const temp_path = path.join(request.user.directories.assets, 'temp', request.body.filename);
 +        const file_path = path.join(request.user.directories.assets, category, request.body.filename);
 +        console.info('Request received to download', url, 'to', file_path);
 -    try {
         // Download to temp
         const res = await fetch(url);
         if (!res.ok || res.body === null) {

src/endpoints/content-manager.js+2 -2 Viewed

  * @param {String} url URL to strip
  * @returns {String} Domain name
  */
 export function getHostFromUrl(url) {
     try {
         const urlObj = new URL(url);
         return urlObj.hostname;

  * @param {String} host Host to check
  * @returns {boolean} If the host is on the whitelist.
  */
 export function isHostWhitelisted(host) {
     return WHITELIST_GENERIC_URL_DOWNLOAD_SOURCES.includes(host);
+}