versia-pub/server
2
0
Fork 0
mirror of https://github.com/versia-pub/server.git synced 2026-03-13 05:49:16 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(media): 🐛 Don't proxy media from trusted origins, use new ProxiedUrl class
Some checks failed
CodeQL Scan / Analyze (javascript-typescript) (push) Failing after 6s
Details
Build Docker Images / lint (push) Failing after 10s
Details
Build Docker Images / check (push) Failing after 11s
Details
Build Docker Images / tests (push) Failing after 27s
Details
Build Docker Images / build (server, Dockerfile, ${{ github.repository_owner }}/server) (push) Has been skipped
Details
Build Docker Images / build (worker, Worker.Dockerfile, ${{ github.repository_owner }}/worker) (push) Has been skipped
Details
Deploy Docs to GitHub Pages / build (push) Failing after 6s
Details
Mirror to Codeberg / Mirror (push) Failing after 0s
Details
Deploy Docs to GitHub Pages / Deploy (push) Has been skipped
Details
Nix Build / check (push) Failing after 5s
Details

Browse source
This commit is contained in:
Jesse Wierzbinski 2025-03-30 23:44:50 +02:00
parent 411fcd8af5
commit dc1ddb758d
No known key found for this signature in database
14 changed files with 114 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

17
utils/response.ts
View file

@ -1,17 +0,0 @@
import { config } from "~/config.ts";
export type Json =
| string
| number
| boolean
| null
| undefined
| Json[]
| { [key: string]: Json };
export const proxyUrl = (url: URL): URL => {
const urlAsBase64Url = Buffer.from(url.toString() || "").toString(
"base64url",
);
return new URL(`/media/proxy/${urlAsBase64Url}`, config.http.base_url);
};

8
utils/sanitization.ts
View file

@ -1,6 +1,6 @@
import { stringifyEntitiesLight } from "stringify-entities";
import xss, { type IFilterXSSOptions } from "xss";
import { proxyUrl } from "./response.ts";
import { ProxiableUrl } from "~/classes/media/url.ts";
export const sanitizedHtmlStrip = (html: string): Promise<string> => {
return sanitizeHtml(html, {
@ -137,9 +137,9 @@ export const sanitizeHtml = async (
element.setAttribute(
"src",
element.getAttribute("src")
? proxyUrl(
new URL(element.getAttribute("src") as string),
).toString()
? new ProxiableUrl(
element.getAttribute("src") as string,
).proxied
: "",
);
},