Check URL against all known cloud domains, plus make it case insensitive

snap7
Bernat Romagosa 2021-07-23 07:34:23 +02:00
rodzic b956a49c86
commit 14c4285acf
1 zmienionych plików z 12 dodań i 2 usunięć

Wyświetl plik

@ -3666,8 +3666,18 @@ Process.prototype.reportURL = function (url) {
Process.prototype.checkURLAllowed = function (url) {
if ([ 'users', 'logout', 'projects', 'collections' ].some(
which => url.match(`snap\.berkeley\.edu.*${which}`))
) {
pathPart => {
// Check out whether we're targeting one of the remote domains
return Object.values(Cloud.prototype.knownDomains).filter(
each => each.includes('snap')
).some(
domain => url.match(
// Check only against the host -not the protocol, path or
// port- of the domain
new RegExp(`${(new URL(domain)).host}.*${pathPart}`, 'i'))
)
}
)) {
throw new Error('Request blocked');
}
};