Merge commit from fork

232cf6d8255e772a55f64d965c6beb85cfbe931d

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

src/endpoints/assets.js+15 -3 Viewed

 import fetch from 'node-fetch';
 import { UNSAFE_EXTENSIONS } from '../constants.js';
-import { clientRelativePath } from '../util.js';
+import { clientRelativePath, isValidUrl } from '../util.js';
+import { getHostFromUrl, isHostWhitelisted } from './content-manager.js';
 const VALID_CATEGORIES = ['bgm', 'ambient', 'blip', 'live2d', 'vrm', 'character', 'temp'];

  * @returns {void}
  */
 router.post('/download', async (request, response) => {
-    const url = request.body.url;
+    try {
+        if (!isValidUrl(request.body.url)) {
+            console.warn('Asset download failed: Must be a valid URL');
+            return response.sendStatus(400);
+        }
+        const url = String(request.body.url);
         const inputCategory = request.body.category;
+        const host = getHostFromUrl(url);
+        if (!isHostWhitelisted(host)) {
+            console.error(`Received an import for "${host}", but site is not whitelisted. This domain must be added to the config key "whitelistImportDomains" to allow import from this source.`);
+            return response.sendStatus(404);
+        }
         // Check category
         let category = null;
         for (let i of VALID_CATEGORIES)

         const file_path = path.join(request.user.directories.assets, category, request.body.filename);
         console.info('Request received to download', url, 'to', file_path);
-    try {
         // Download to temp
         const res = await fetch(url);
         if (!res.ok || res.body === null) {

src/endpoints/content-manager.js+2 -2 Viewed

  * @param {String} url URL to strip
  * @returns {String} Domain name
  */
-function getHostFromUrl(url) {
+export function getHostFromUrl(url) {
     try {
         const urlObj = new URL(url);
         return urlObj.hostname;

  * @param {String} host Host to check
  * @returns {boolean} If the host is on the whitelist.
  */
-function isHostWhitelisted(host) {
+export function isHostWhitelisted(host) {
     return WHITELIST_GENERIC_URL_DOWNLOAD_SOURCES.includes(host);
+}