apGetでcheckAllowedUrl

src/remote/activitypub/request.ts

@@ -1,9 +1,10 @@
 import config from '../../config';
-import { getResponse } from '../../misc/fetch';
+import { StatusError, getResponse } from '../../misc/fetch';
 import { createSignedPost, createSignedGet } from './ap-request';
 import { ILocalUser } from '../../models/user';
 import { ThinUserWithKey } from '../../queue/types';
 import type { Response } from 'got';
+import { checkAllowedUrl } from '../../misc/check-allowed-url';
 
 export default async (user: ThinUserWithKey, url: string, object: any, digest?: string) => {
 	const body = typeof object === 'string' ? object : JSON.stringify(object);
@@ -40,6 +41,10 @@ export default async (user: ThinUserWithKey, url: string, object: any, digest?:
 export async function apGet(url: string, user?: ILocalUser) {
 	let res: Response<string>;
 
+	if (!checkAllowedUrl(url)) {
+		throw new StatusError('Invalid URL', 400);
+	}
+
 	if (user) {
 		const req = createSignedGet({
 			key: {