oscar-surf/misskey
oscar-surf/misskey
0
0
Fork 0
Code Issues Activity

hotfix(backend): GHSA-qqrm-9grj-6v32 (MisskeyIO#460)

Browse source 
* hotfix(backend): GHSA-qqrm-9grj-6v32

Cherry-picked from 9a70ce8f5e

Co-authored-by: tamaina <tamaina@hotmail.co.jp>

* security fix: regexp

Co-authored-by: Ry0taK <49341894+Ry0taK@users.noreply.github.com>

---------

Co-authored-by: tamaina <tamaina@hotmail.co.jp>
Co-authored-by: Ry0taK <49341894+Ry0taK@users.noreply.github.com>
This commit is contained in:
まっちゃとーにゅ 2024-02-17 15:23:56 +09:00 • committed by GitHub
parent 8325431d4e
commit d5f229e72b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 144 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

55
packages/backend/src/core/HttpRequestService.ts
View file

@ -14,9 +14,16 @@ import { DI } from '@/di-symbols.js';
import type { Config } from '@/config.js';
import { StatusError } from '@/misc/status-error.js';
import { bindThis } from '@/decorators.js';
import { validateContentTypeSetAsActivityPub } from '@/core/activitypub/misc/validator.js';
import type { IObject } from '@/core/activitypub/type.js';
import type { Response } from 'node-fetch';
import type { URL } from 'node:url';
export type HttpRequestSendOptions = {
throwErrorWhenResponseNotOk: boolean;
validators?: ((res: Response) => void)[];
};
@Injectable()
export class HttpRequestService {
/**
@ -104,6 +111,23 @@ export class HttpRequestService {
}
}
@bindThis
public async getActivityJson(url: string): Promise<IObject> {
const res = await this.send(url, {
method: 'GET',
headers: {
Accept: 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
},
timeout: 5000,
size: 1024 * 256,
}, {
throwErrorWhenResponseNotOk: true,
validators: [validateContentTypeSetAsActivityPub],
});
return await res.json() as IObject;
}
@bindThis
public async getJson<T = unknown>(url: string, accept = 'application/json, */*', headers?: Record<string, string>): Promise<T> {
const res = await this.send(url, {
@ -132,17 +156,20 @@ export class HttpRequestService {
}
@bindThis
public async send(url: string, args: {
method?: string,
body?: string,
headers?: Record<string, string>,
timeout?: number,
size?: number,
} = {}, extra: {
throwErrorWhenResponseNotOk: boolean;
} = {
throwErrorWhenResponseNotOk: true,
}): Promise<Response> {
public async send(
url: string,
args: {
method?: string,
body?: string,
headers?: Record<string, string>,
timeout?: number,
size?: number,
} = {},
extra: HttpRequestSendOptions = {
throwErrorWhenResponseNotOk: true,
validators: [],
},
): Promise<Response> {
const timeout = args.timeout ?? 5000;
const controller = new AbortController();
@ -169,6 +196,12 @@ export class HttpRequestService {
throw new StatusError(`${res.status} ${res.statusText}`, res.status, res.statusText);
}
if (res.ok) {
for (const validator of (extra.validators ?? [])) {
validator(res);
}
}
return res;
}