mirror/advplyr.audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2025-06-26 18:59:25 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Update:API endpoint /podcasts/feed validates rssFeed URL and uses SSRF req filter

Browse source
This commit is contained in:
advplyr 2023-12-17 12:00:11 -06:00
parent dc67a52000
commit f2f2ea161c
3 changed files with 57 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
server/controllers/PodcastController.js
View file

@ -6,6 +6,7 @@ const fs = require('../libs/fsExtra')
const { getPodcastFeed, findMatchingEpisodes } = require('../utils/podcastUtils')
const { getFileTimestampsWithIno, filePathToPOSIX } = require('../utils/fileUtils')
const { validateUrl } = require('../utils/index')
const Scanner = require('../scanner/Scanner')
const CoverManager = require('../managers/CoverManager')
@ -102,15 +103,24 @@ class PodcastController {
}
}
/**
* POST: /api/podcasts/feed
*
* @typedef getPodcastFeedReqBody
* @property {string} rssFeed
*
* @param {import('express').Request<{}, {}, getPodcastFeedReqBody, {}} req
* @param {import('express').Response} res
*/
async getPodcastFeed(req, res) {
if (!req.user.isAdminOrUp) {
Logger.error(`[PodcastController] Non-admin user "${req.user.username}" attempted to get podcast feed`)
return res.sendStatus(403)
}
var url = req.body.rssFeed
const url = validateUrl(req.body.rssFeed)
if (!url) {
return res.status(400).send('Bad request')
return res.status(400).send('Invalid request body. "rssFeed" must be a valid URL')
}
const podcast = await getPodcastFeed(url)