Merge commit from fork

232cf6d8255e772a55f64d965c6beb85cfbe931d

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

src/endpoints/assets.js+15 -3 Viewed

 import fetch from 'node-fetch';
 import { UNSAFE_EXTENSIONS } from '../constants.js';
 import { clientRelativePath, isValidUrl } from '../util.js';
 +import { getHostFromUrl, isHostWhitelisted } from './content-manager.js';
 const VALID_CATEGORIES = ['bgm', 'ambient', 'blip', 'live2d', 'vrm', 'character', 'temp'];

  * @returns {void}
  */
 router.post('/download', async (request, response) => {
 -    const url = request.body.url;
 +    try {
 +        if (!isValidUrl(request.body.url)) {
 +            console.warn('Asset download failed: Must be a valid URL');
 +            return response.sendStatus(400);
 +        }
++
 +        const url = String(request.body.url);
         const inputCategory = request.body.category;
 +        const host = getHostFromUrl(url);
 +        if (!isHostWhitelisted(host)) {
 +            console.error(`Received an import for "${host}", but site is not whitelisted. This domain must be added to the config key "whitelistImportDomains" to allow import from this source.`);
 +            return response.sendStatus(404);
 +        }
++
         // Check category
         let category = null;
         for (let i of VALID_CATEGORIES)

         const file_path = path.join(request.user.directories.assets, category, request.body.filename);
         console.info('Request received to download', url, 'to', file_path);
 -    try {
         // Download to temp
         const res = await fetch(url);
         if (!res.ok || res.body === null) {

src/endpoints/content-manager.js+2 -2 Viewed

  * @param {String} url URL to strip
  * @returns {String} Domain name
  */
 export function getHostFromUrl(url) {
     try {
         const urlObj = new URL(url);
         return urlObj.hostname;

  * @param {String} host Host to check
  * @returns {boolean} If the host is on the whitelist.
  */
 export function isHostWhitelisted(host) {
     return WHITELIST_GENERIC_URL_DOWNLOAD_SOURCES.includes(host);
+}