rainbownapkin/canopy
1
0
Fork 0
Code Issues 20 Pull requests Projects Releases Packages Wiki Activity Actions

Improved link validation and sanatization, in order to mitigate CVE-2025-56200 from validator.js NPM package.

Browse source
This commit is contained in:
rainbow napkin 2025-10-18 07:21:17 -04:00
parent 6bab5b4723
commit 06f552a9ec
9 changed files with 38 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/app/channel/media/playlistHandler.js
View file

@ -120,12 +120,12 @@ class playlistHandler{
*/
async addToPlaylistValidator(socket, url){
//If we where given a bad URL
if(typeof url != 'string' || !validator.isURL(url)){
if(typeof url != 'string' || !validator.isURL(url,{require_valid_protocol: true})){
//Attempt to fix the situation by encoding it
url = encodeURI(url);
//If it's still bad
if(typeof url != 'string' || !validator.isURL(url)){
if(typeof url != 'string' || !validator.isURL(url,{require_valid_protocol: true})){
//Bitch, moan, complain...
loggerUtils.socketErrorHandler(socket, "Bad URL!", "validation");
//and ignore it!

4
src/app/channel/media/queue.js
View file

@ -132,12 +132,12 @@ class queue{
let url = data.url;
//If we where given a bad URL
if(!validator.isURL(url)){
if(!validator.isURL(url,{require_valid_protocol: true})){
//Attempt to fix the situation by encoding it
url = encodeURI(url);
//If it's still bad
if(!validator.isURL(url)){
if(!validator.isURL(url,{require_valid_protocol: true})){
//Bitch, moan, complain...
loggerUtils.socketErrorHandler(socket, "Bad URL!", "validation");
//and ignore it!