Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: undefined check, allow plugins to append to allow list

Browse Source
This commit is contained in:
Julian Lam
2025-05-23 13:57:25 -04:00
parent df36021628
commit 70c04f0cb2
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
install/package.json
View File

@@ -145,6 +145,7 @@
"tinycon": "0.6.8", "tinycon": "0.6.8",
"toobusy-js": "0.5.1", "toobusy-js": "0.5.1",
"tough-cookie": "5.1.2", "tough-cookie": "5.1.2",
"undici": "^7.10.0",
"validator": "13.15.15", "validator": "13.15.15",
"webpack": "5.99.9", "webpack": "5.99.9",
"webpack-merge": "6.0.1", "webpack-merge": "6.0.1",

22
src/request.js
View File

@@ -8,10 +8,13 @@ const { CookieJar } = require('tough-cookie');
const fetchCookie = require('fetch-cookie').default; const fetchCookie = require('fetch-cookie').default;
const { version } = require('../package.json'); const { version } = require('../package.json');
const plugins = require('./plugins');
const ttl = require('./cache/ttl'); const ttl = require('./cache/ttl');
const checkCache = ttl({ const checkCache = ttl({
ttl: 1000 * 60 * 60, // 1 hour ttl: 1000 * 60 * 60, // 1 hour
}); });
let allowList = new Set();
let initialized = false;
exports.jar = function () { exports.jar = function () {
return new CookieJar(); return new CookieJar();
@@ -19,6 +22,19 @@ exports.jar = function () {
const userAgent = `NodeBB/${version.split('.').shift()}.x (${nconf.get('url')})`; const userAgent = `NodeBB/${version.split('.').shift()}.x (${nconf.get('url')})`;
async function init() {
if (initialized) {
return;
}
allowList.add(nconf.get('url_parsed').host);
const { allowed } = await plugins.hooks.fire('filter:request.init', { allowed: allowList });
if (allowed instanceof Set) {
allowList = allowed;
}
initialized = true;
}
// Initialize fetch - somewhat hacky, but it's required for globalDispatcher to be available // Initialize fetch - somewhat hacky, but it's required for globalDispatcher to be available
async function call(url, method, { body, timeout, jar, ...config } = {}) { async function call(url, method, { body, timeout, jar, ...config } = {}) {
const ok = await check(url); const ok = await check(url);
@@ -90,13 +106,15 @@ async function call(url, method, { body, timeout, jar, ...config } = {}) {
// Checks url to ensure it is not in reserved IP range (private, etc.) // Checks url to ensure it is not in reserved IP range (private, etc.)
async function check(url) { async function check(url) {
await init();
const { host } = new URL(url); const { host } = new URL(url);
if (host === nconf.get('url_parsed').host) { if (allowList.has(host)) {
return true; return true;
} }
const cached = checkCache.get(url); const cached = checkCache.get(url);
if (cached) { if (cached !== undefined) {
return cached; return cached;
} }