TudbuT/conduit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dont drop true error with url str parse, fix url contains logic order, clarify config comment

Browse source 
Signed-off-by: strawberry <strawberry@puppygock.gay>
This commit is contained in:
strawberry 2024-02-10 12:28:49 -05:00 • committed by June
parent 7786553cda
commit 2ea895199a
2 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
conduwuit-example.toml
View file

@ -176,7 +176,7 @@ url_preview_domain_contains_allowlist = []
url_preview_domain_explicit_allowlist = []
# Vector list of URLs allowed to send requests to for URL previews. Defaults to none.
# Note that this is a *contains* match, not an explicit match. Putting "https://google.com" will match "https://google.com/" and "https://google.com/url?q=https://mymaliciousdomainexample.com"
# Note that this is a *contains* match, not an explicit match. Putting "google.com" will match "https://google.com/", "https://google.com/url?q=https://mymaliciousdomainexample.com", and "https://mymaliciousdomainexample.com/hi/google.com"
# Setting this to "*" will allow all URL previews. Please note that this opens up significant attack surface to your server, you are expected to be aware of the risks by doing so.
url_preview_url_contains_allowlist = []

9
src/api/client_server/media.rs
View file

@ -14,7 +14,7 @@ use ruma::api::client::{
get_media_config, get_media_preview,
},
};
use tracing::{debug, error, info};
use tracing::{debug, error, info, warn};
use webpage::HTML;
/// generated MXC ID (`media-id`) length
@ -500,7 +500,10 @@ async fn get_url_preview(url: &str) -> Result<UrlPreviewData> {
fn url_preview_allowed(url_str: &str) -> bool {
let url: Url = match Url::parse(url_str) {
Ok(u) => u,
Err(_) => return false,
Err(e) => {
warn!("Failed to parse URL from a str: {}", e);
return false;
}
};
if ["http", "https"]
@ -559,7 +562,7 @@ fn url_preview_allowed(url_str: &str) -> bool {
if allowlist_url_contains
.iter()
.any(|url_s| url_s.contains(&url.to_string()))
.any(|url_s| url.to_string().contains(&url_s.to_string()))
{
return true;
}