LogalDeveloper/owncast
LogalDeveloper/owncast
0
Fork 0
Code

fix: disable redirects to guard against possible SSRFs

Browse Source
This commit is contained in:
Gabe Kangas 2023-04-24 17:46:58 -07:00
parent b8fe446152
commit f40135dbf2
No known key found for this signature in database
GPG Key ID: 4345B2060657F330
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
activitypub/webfinger/webfinger.go
View File

@ -29,7 +29,14 @@ func GetWebfingerLinks(account string) ([]map[string]interface{}, error) {
query.Add("resource", fmt.Sprintf("acct:%s", account))
requestURL.RawQuery = query.Encode()
response, err := http.DefaultClient.Get(requestURL.String())
// Do not support redirects.
client := &http.Client{
CheckRedirect: func(req *http.Request, via []*http.Request) error {
return http.ErrUseLastResponse
},
}
response, err := client.Get(requestURL.String())
if err != nil {
return nil, err
}

8
auth/indieauth/client.go
View File

@ -80,7 +80,13 @@ func HandleCallbackCode(code, state string) (*Request, *Response, error) {
data.Set("redirect_uri", request.Callback.String())
data.Set("code_verifier", request.CodeVerifier)
client := &http.Client{}
// Do not support redirects.
client := &http.Client{
CheckRedirect: func(req *http.Request, via []*http.Request) error {
return http.ErrUseLastResponse
},
}
r, err := http.NewRequest("POST", request.Endpoint.String(), strings.NewReader(data.Encode())) // URL-encoded payload
if err != nil {
return nil, nil, err