kamp/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2024-09-21 03:40:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: patch footer icon self-xss from privledged user

Browse Source
This commit is contained in:
timothycarambat 2024-03-29 13:39:11 -07:00
parent bfedfebfab
commit 49f30e051c
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
server/models/systemSettings.js
View File

@ -2,6 +2,7 @@ process.env.NODE_ENV === "development"
? require("dotenv").config({ path: `.env.${process.env.NODE_ENV}` })
: require("dotenv").config();
const { isValidUrl } = require("../utils/http");
const prisma = require("../utils/prisma");
const SystemSettings = {
@ -18,8 +19,10 @@ const SystemSettings = {
validations: {
footer_data: (updates) => {
try {
const array = JSON.parse(updates);
return JSON.stringify(array.slice(0, 3)); // max of 3 items in footer.
const array = JSON.parse(updates)
.filter((setting) => isValidUrl(setting.url))
.slice(0, 3); // max of 3 items in footer.
return JSON.stringify(array);
} catch (e) {
console.error(`Failed to run validation function on footer_data`);
return JSON.stringify([]);

10
server/utils/http/index.js
View File

@ -68,6 +68,15 @@ function safeJsonParse(jsonString, fallback = null) {
return fallback;
}
function isValidUrl(urlString = "") {
try {
const url = new URL(urlString);
if (!["http:", "https:"].includes(url.protocol)) return false;
return true;
} catch (e) {}
return false;
}
module.exports = {
reqBody,
multiUserMode,
@ -77,4 +86,5 @@ module.exports = {
userFromSession,
parseAuthHeader,
safeJsonParse,
isValidUrl,
};