Mirrors/uppy
1
0
Fork 0
mirror of https://github.com/transloadit/uppy.git synced 2026-07-25 11:14:05 +00:00
Code Issues Projects Releases Wiki Activity

companion: support relative redirect URLs in responses (#2901)

Browse source
This commit is contained in:
Renée Kooi 2021-05-26 10:28:40 +02:00 • committed by GitHub
parent c2c568279b
commit bc54aeb3f5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
packages/@uppy/companion/src/server/helpers/request.js
View file

@ -79,15 +79,21 @@ function isPrivateIP (ipAddress) {
module.exports.FORBIDDEN_IP_ADDRESS = FORBIDDEN_IP_ADDRESS
module.exports.getRedirectEvaluator = (requestURL, blockPrivateIPs) => {
const { protocol } = new URL(requestURL)
module.exports.getRedirectEvaluator = (rawRequestURL, blockPrivateIPs) => {
const requestURL = new URL(rawRequestURL)
return (res) => {
if (!blockPrivateIPs) {
return true
}
const redirectURL = res.headers.location
const shouldRedirect = redirectURL ? new URL(redirectURL).protocol === protocol : false
let redirectURL = null
try {
redirectURL = new URL(res.headers.location, requestURL)
} catch (err) {
return false
}
const shouldRedirect = redirectURL.protocol === requestURL.protocol
if (!shouldRedirect) {
logger.info(
`blocking redirect from ${requestURL} to ${redirectURL}`, 'redirect.protection'