75f3a0ed04
- Added a new test suite for attack vectors targeting the /discover federation routes, ensuring (known) vulnerabilities are addressed. - Implemented a proxy function to check for blacklisted servers, enhancing security measures. - Introduced URL validation to prevent SSRF attacks by blocking internal addresses. - Updated package.json with a new test command for the attack tests. - Refactored server and route handling to improve type safety and error handling. - Added new middleware for blacklist checks and URL validation to prevent unauthorized access.
19 lines
No EOL
569 B
TypeScript
19 lines
No EOL
569 B
TypeScript
import db from "@/lib/db";
|
|
import { blacklistedServers } from "@/lib/db/schema";
|
|
import createDebug from "debug";
|
|
import { eq } from "drizzle-orm";
|
|
|
|
const debug = createDebug("federation:blacklist");
|
|
|
|
/**
|
|
* Check if a server URL is blacklisted.
|
|
* Exported so route handlers can call it with body-extracted URLs.
|
|
*/
|
|
export async function isBlacklisted(serverUrl: string): Promise<boolean> {
|
|
const [row] = await db
|
|
.select({ id: blacklistedServers.id })
|
|
.from(blacklistedServers)
|
|
.where(eq(blacklistedServers.serverUrl, serverUrl))
|
|
.limit(1);
|
|
return !!row;
|
|
} |