From 0db6c3b2aa1787a7054ffdaba975474f122c20eb Mon Sep 17 00:00:00 2001
From: Timothy Carambat <rambat1010@gmail.com>
Date: Fri, 19 Jan 2024 10:49:40 -0800
Subject: [PATCH] Prevent private octets from link collection for self-hosted
 (#626)

---
 collector/utils/url/index.js | 14 ++++++++++++++
 server/endpoints/system.js   |  5 +----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/collector/utils/url/index.js b/collector/utils/url/index.js
index 419c02c2..e8cd4a76 100644
--- a/collector/utils/url/index.js
+++ b/collector/utils/url/index.js
@@ -1,9 +1,23 @@
 const VALID_PROTOCOLS = ["https:", "http:"];
+const INVALID_OCTETS = [192, 172, 10, 127];
+
+function isInvalidIp({ hostname }) {
+  const IPRegex = new RegExp(
+    /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/gi
+  );
+  if (!IPRegex.test(hostname)) return false;
+  const [octetOne, ..._rest] = hostname.split(".");
+
+  // If fails to validate to number - abort and return as invalid.
+  if (isNaN(Number(octetOne))) return true;
+  return INVALID_OCTETS.includes(Number(octetOne));
+}
 
 function validURL(url) {
   try {
     const destination = new URL(url);
     if (!VALID_PROTOCOLS.includes(destination.protocol)) return false;
+    if (isInvalidIp(destination)) return false;
     return true;
   } catch {}
   return false;
diff --git a/server/endpoints/system.js b/server/endpoints/system.js
index 29f5ab4f..3f11bf5e 100644
--- a/server/endpoints/system.js
+++ b/server/endpoints/system.js
@@ -16,10 +16,7 @@ const {
   multiUserMode,
   queryParams,
 } = require("../utils/http");
-const {
-  setupLogoUploads,
-  setupPfpUploads,
-} = require("../utils/files/multer");
+const { setupLogoUploads, setupPfpUploads } = require("../utils/files/multer");
 const { v4 } = require("uuid");
 const { SystemSettings } = require("../models/systemSettings");
 const { User } = require("../models/user");