refactor: validateURLForSSRF()

This commit is contained in:
2025-11-11 16:10:20 +01:00
parent 0026d0d645
commit 325cbe9c2c

View File

@@ -450,38 +450,24 @@ func (s *URLMetadataService) optimizedTitleClean(title string) string {
} }
func (s *URLMetadataService) validateURLForSSRF(u *url.URL) error { func (s *URLMetadataService) validateURLForSSRF(u *url.URL) error {
if u == nil { switch {
case u == nil,
u.Scheme != "http" && u.Scheme != "https",
u.Host == "",
u.Hostname() == "",
isLocalhost(u.Hostname()):
return ErrSSRFBlocked return ErrSSRFBlocked
} }
if u.Scheme != "http" && u.Scheme != "https" { ips, err := s.resolver.LookupIP(u.Hostname())
return ErrSSRFBlocked
}
if u.Host == "" {
return ErrSSRFBlocked
}
hostname := u.Hostname()
if hostname == "" {
return ErrSSRFBlocked
}
if isLocalhost(hostname) {
return ErrSSRFBlocked
}
ips, err := s.resolver.LookupIP(hostname)
if err != nil { if err != nil {
return ErrSSRFBlocked return ErrSSRFBlocked
} }
for _, ip := range ips { for _, ip := range ips {
if isPrivateOrReservedIP(ip) { if isPrivateOrReservedIP(ip) {
return ErrSSRFBlocked return ErrSSRFBlocked
} }
} }
return nil return nil
} }