fix: isLocalResourse for proxy (#103)

GHSA-4c78-229v-hf6m
TxtDot · Mar 5, 2024 · f241a46 · f241a46
1 parent a7fdaf8
commit f241a46
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "txtdot",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "private": true,
   "description": "txtdot is an HTTP proxy that parses only text, links and pictures from pages reducing internet bandwidth usage, removing ads and heavy scripts",
   "main": "dist/app.js",

diff --git a/src/routes/browser/proxy.ts b/src/routes/browser/proxy.ts
@@ -2,11 +2,18 @@ import { FastifyInstance } from 'fastify';
 import { IProxySchema, ProxySchema } from '../../types/requests/browser';
 import axios from '../../types/axios';
 
+import isLocalResource from '../../utils/islocal';
+import { LocalResourceError } from '../../errors/main';
+
 export default async function proxyRoute(fastify: FastifyInstance) {
   fastify.get<IProxySchema>(
     '/proxy',
     { schema: ProxySchema },
     async (request, reply) => {
+      if (await isLocalResource(new URL(request.query.url))) {
+        throw new LocalResourceError();
+      }
+
       const response = await axios.get(request.query.url);
       const mime: string | undefined =
         response.headers['content-type']?.toString();