diff options
| author | FineArchs <133759614+FineArchs@users.noreply.github.com> | 2023-09-24 14:41:41 +0900 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-24 14:41:41 +0900 |
| commit | 30b231225c85abd269c005153167e6827bfc7921 (patch) | |
| tree | 762aef1609386319424371a43c2580b42499972a /packages/frontend/src/scripts/aiscript/api.ts | |
| parent | tweak ui (diff) | |
| download | sharkey-30b231225c85abd269c005153167e6827bfc7921.tar.gz sharkey-30b231225c85abd269c005153167e6827bfc7921.tar.bz2 sharkey-30b231225c85abd269c005153167e6827bfc7921.zip | |
Mk:apiで外部サーバーとの接続を禁止 (#11883)
* Mk:url(): no automatic token attaching when ep is url
* Limit requests to external servers by Mk:api
* remove unused import
* Update CHANGELOG.md
* Update packages/frontend/src/scripts/aiscript/api.ts
Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>
---------
Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>
Diffstat (limited to 'packages/frontend/src/scripts/aiscript/api.ts')
| -rw-r--r-- | packages/frontend/src/scripts/aiscript/api.ts | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/packages/frontend/src/scripts/aiscript/api.ts b/packages/frontend/src/scripts/aiscript/api.ts index 0bb9185936..9f60e52cea 100644 --- a/packages/frontend/src/scripts/aiscript/api.ts +++ b/packages/frontend/src/scripts/aiscript/api.ts @@ -34,12 +34,15 @@ export function createAiScriptEnv(opts) { return confirm.canceled ? values.FALSE : values.TRUE; }), 'Mk:api': values.FN_NATIVE(async ([ep, param, token]) => { + utils.assertString(ep); + if (ep.value.includes('://')) throw new Error('invalid endpoint'); if (token) { utils.assertString(token); // バグがあればundefinedもあり得るため念のため if (typeof token.value !== 'string') throw new Error('invalid token'); } - return os.api(ep.value, utils.valToJs(param), token ? token.value : (opts.token ?? null)).then(res => { + const actualToken: string|null = token?.value ?? opts.token ?? null; + return os.api(ep.value, utils.valToJs(param), actualToken).then(res => { return utils.jsToVal(res); }, err => { return values.ERROR('request_failed', utils.jsToVal(err)); |