TudbuT/conduit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dont drop true error with url str parse, fix url contains logic order, clarify config comment

Browse source 
Signed-off-by: strawberry <strawberry@puppygock.gay>
This commit is contained in:
strawberry 2024-02-10 12:28:49 -05:00 • committed by June
parent 7786553cda
commit 2ea895199a
2 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
conduwuit-example.toml
View file

@ -176,7 +176,7 @@ url_preview_domain_contains_allowlist = []
url_preview_domain_explicit_allowlist = [] url_preview_domain_explicit_allowlist = []
# Vector list of URLs allowed to send requests to for URL previews. Defaults to none. # Vector list of URLs allowed to send requests to for URL previews. Defaults to none.
# Note that this is a *contains* match, not an explicit match. Putting "https://google.com" will match "https://google.com/" and "https://google.com/url?q=https://mymaliciousdomainexample.com" # Note that this is a *contains* match, not an explicit match. Putting "google.com" will match "https://google.com/", "https://google.com/url?q=https://mymaliciousdomainexample.com", and "https://mymaliciousdomainexample.com/hi/google.com"
# Setting this to "*" will allow all URL previews. Please note that this opens up significant attack surface to your server, you are expected to be aware of the risks by doing so. # Setting this to "*" will allow all URL previews. Please note that this opens up significant attack surface to your server, you are expected to be aware of the risks by doing so.
url_preview_url_contains_allowlist = [] url_preview_url_contains_allowlist = []

9
src/api/client_server/media.rs
View file

@ -14,7 +14,7 @@ use ruma::api::client::{
get_media_config, get_media_preview, get_media_config, get_media_preview,
}, },
}; };
use tracing::{debug, error, info}; use tracing::{debug, error, info, warn};
use webpage::HTML; use webpage::HTML;
/// generated MXC ID (`media-id`) length /// generated MXC ID (`media-id`) length
@ -500,7 +500,10 @@ async fn get_url_preview(url: &str) -> Result<UrlPreviewData> {
fn url_preview_allowed(url_str: &str) -> bool { fn url_preview_allowed(url_str: &str) -> bool {
let url: Url = match Url::parse(url_str) { let url: Url = match Url::parse(url_str) {
Ok(u) => u, Ok(u) => u,
Err(_) => return false, Err(e) => {
warn!("Failed to parse URL from a str: {}", e);
return false;
}
}; };
if ["http", "https"] if ["http", "https"]
@ -559,7 +562,7 @@ fn url_preview_allowed(url_str: &str) -> bool {
if allowlist_url_contains if allowlist_url_contains
.iter() .iter()
.any(|url_s| url_s.contains(&url.to_string())) .any(|url_s| url.to_string().contains(&url_s.to_string()))
{ {
return true; return true;
} }