kibi/f0ckm
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

metayt

Browse Source
This commit is contained in:
Kibi Kelburton
2026-07-15 18:49:05 +02:00
parent 5ef981d35b
commit 98c2aa3b7f
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/inc/routes/apiv2/index.mjs
View File

@@ -300,8 +300,8 @@ export default router => {
}); });
// F-002 Security: Require authentication to prevent SSRF via arbitrary URL fetching. // F-002 Security: Require authentication to prevent SSRF via arbitrary URL fetching.
// Guests use cached entries from DB (populated by authenticated user requests). // Guests may read from the cache (in-memory or DB); only authenticated users trigger real outbound fetches.
group.get(/\/meta\/fetch$/, lib.loggedin, async (req, res) => { group.get(/\/meta\/fetch$/, async (req, res) => {
if (!cfg.websrv.web_meta_extraction) { if (!cfg.websrv.web_meta_extraction) {
return res.json({ success: false, msg: 'Metadata extraction is disabled' }, 403); return res.json({ success: false, msg: 'Metadata extraction is disabled' }, 403);
} }
@@ -325,6 +325,11 @@ export default router => {
console.error('[META-CACHE] DB lookup failed:', err); console.error('[META-CACHE] DB lookup failed:', err);
} }
// Cache miss — require auth to perform real outbound fetch (SSRF prevention)
if (!req.session) {
return res.json({ success: false, msg: 'Not cached' }, 401);
}
const setCache = async (u, m) => { const setCache = async (u, m) => {
if (!m || !m.title) return; if (!m || !m.title) return;
metaCache.set(u, m); metaCache.set(u, m);