Merge commit from fork

232cf6d8255e772a55f64d965c6beb85cfbe931d

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: 734ef7d939b2159456defceff348273ee4eb85c2

src/endpoints/assets.js+33 -21 Viewed

 import fetch from 'node-fetch';
 import { UNSAFE_EXTENSIONS } from '../constants.js';
-import { clientRelativePath } from '../util.js';
+import { clientRelativePath, isValidUrl } from '../util.js';
+import { getHostFromUrl, isHostWhitelisted } from './content-manager.js';
 const VALID_CATEGORIES = ['bgm', 'ambient', 'blip', 'live2d', 'vrm', 'character', 'temp'];

  * @returns {void}
  */
 router.post('/download', async (request, response) => {
-    const url = request.body.url;
+    try {
-    const inputCategory = request.body.category;
+        if (!isValidUrl(request.body.url)) {
+            console.warn('Asset download failed: Must be a valid URL');
+            return response.sendStatus(400);
+        }
-    // Check category
+        const url = String(request.body.url);
-    let category = null;
+        const inputCategory = request.body.category;
-    for (let i of VALID_CATEGORIES)
-        if (i == inputCategory)
-            category = i;
-    if (category === null) {
+        const host = getHostFromUrl(url);
-        console.error('Bad request: unsupported asset category.');
+        if (!isHostWhitelisted(host)) {
-        return response.sendStatus(400);
+            console.error(`Received an import for "${host}", but site is not whitelisted. This domain must be added to the config key "whitelistImportDomains" to allow import from this source.`);
-    }
+            return response.sendStatus(404);
+        }
-    // Validate filename
+        // Check category
-    ensureFoldersExist(request.user.directories);
+        let category = null;
-    const validation = validateAssetFileName(request.body.filename);
+        for (let i of VALID_CATEGORIES)
-    if (validation.error)
+            if (i == inputCategory)
-        return response.status(400).send(validation.message);
+                category = i;
-    const temp_path = path.join(request.user.directories.assets, 'temp', request.body.filename);
+        if (category === null) {
-    const file_path = path.join(request.user.directories.assets, category, request.body.filename);
+            console.error('Bad request: unsupported asset category.');
-    console.info('Request received to download', url, 'to', file_path);
+            return response.sendStatus(400);
+        }
+        // Validate filename
+        ensureFoldersExist(request.user.directories);
+        const validation = validateAssetFileName(request.body.filename);
+        if (validation.error)
+            return response.status(400).send(validation.message);
+        const temp_path = path.join(request.user.directories.assets, 'temp', request.body.filename);
+        const file_path = path.join(request.user.directories.assets, category, request.body.filename);
+        console.info('Request received to download', url, 'to', file_path);
-    try {
         // Download to temp
         const res = await fetch(url);
         if (!res.ok || res.body === null) {

src/endpoints/content-manager.js+2 -2 Viewed

  * @param {String} url URL to strip
  * @returns {String} Domain name
  */
-function getHostFromUrl(url) {
+export function getHostFromUrl(url) {
     try {
         const urlObj = new URL(url);
         return urlObj.hostname;

  * @param {String} host Host to check
  * @returns {boolean} If the host is on the whitelist.
  */
-function isHostWhitelisted(host) {
+export function isHostWhitelisted(host) {
     return WHITELIST_GENERIC_URL_DOWNLOAD_SOURCES.includes(host);
+}