search

OP-Engineering / link-preview-js

⛓ Extract web links information: title, description, images, videos, etc. [via OpenGraph], runs on mobiles and node.
MIT License
770 stars 124 forks source link

Fix for SSRF vulnerability #106

Closed aaydin-tr closed 2 years ago

aaydin-tr commented 2 years ago

https://github.com/ospfranco/link-preview-js/issues/105

@ospfranco Can we have a chance to check the url with regex before the redirect? So maybe that way library can check even if followRedirects:true

ospfranco commented 2 years ago

Not sure if it is possible, since at that point the fetch API has taken over, I guess we would need to manually do the requests for redirects... I don't have the time to do such a large feature though

ospfranco commented 2 years ago

Would you mind fixing the failing test? and also adding one more test for erroring when follow redirects is off

ospfranco commented 2 years ago

Do another test with the redirection flag set to false please :)

aaydin-tr commented 2 years ago

Will be ready soon 😊

ospfranco commented 2 years ago

Weird, a couple of other tests broke with a redirection error on the latest run, but not in the first one, any idea why?

aaydin-tr commented 2 years ago

interesting, maybe cause github actions server proxy config

ospfranco commented 2 years ago

re-ran the tests and now they pass... damn, hate heisen-tests, but they have always been flaky, relying on real server responses is never ideal

Anyways, I'll merge it for now and release a new version

ospfranco commented 2 years ago

released under 2.1.13, thanks for the PR

aaydin-tr commented 2 years ago

Thank you so much for attention 👍