diff options
| author | 饺子w (Yumechi) <35571479+eternal-flame-AD@users.noreply.github.com> | 2024-10-22 04:17:56 -0500 |
|---|---|---|
| committer | Marie <github@yuugi.dev> | 2024-10-22 22:30:17 +0200 |
| commit | e05420a92dc6307668727f78e8dc439d5283687b (patch) | |
| tree | 4c136bf5ad4525dfa0da3784a10809a3c1761872 /packages/backend/src | |
| parent | merge: fix: should use invite limit cycle to calculate invite/limit (!706) (diff) | |
| download | sharkey-e05420a92dc6307668727f78e8dc439d5283687b.tar.gz sharkey-e05420a92dc6307668727f78e8dc439d5283687b.tar.bz2 sharkey-e05420a92dc6307668727f78e8dc439d5283687b.zip | |
Merge commit from fork
[ghsa-gq5q-c77c-v236](https://github.com/misskey-dev/misskey/security/advisories/ghsa-gq5q-c77c-v236)
Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
Diffstat (limited to 'packages/backend/src')
| -rw-r--r-- | packages/backend/src/server/FileServerService.ts | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/packages/backend/src/server/FileServerService.ts b/packages/backend/src/server/FileServerService.ts index 19f082c61c..1a4d0cb48f 100644 --- a/packages/backend/src/server/FileServerService.ts +++ b/packages/backend/src/server/FileServerService.ts @@ -317,6 +317,12 @@ export class FileServerService { ); } + if (!request.headers['user-agent']) { + throw new StatusError('User-Agent is required', 400, 'User-Agent is required'); + } else if (request.headers['user-agent'].toLowerCase().indexOf('misskey/') !== -1) { + throw new StatusError('Refusing to proxy a request from another proxy', 403, 'Proxy is recursive'); + } + // Create temp file const file = await this.getStreamAndTypeFromUrl(url); if (file === '404') { |