yakumo.izuru/yukari
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[mod] data scheme URL : allow only images (png, jpeg, pjpeg, gif, webp)

Browse Source 
git-svn-id: file:///srv/svn/repo/yukari/trunk@61 f3bd38d9-da89-464d-a02a-eb04e43141b5
This commit is contained in:
alex 2016-12-01 13:01:22 +00:00
parent b9f693e84b
commit 809239ddc1
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
morty.go
View File

@ -687,7 +687,17 @@ func (rc *RequestConfig) ProxifyURI(uri []byte) (string, error) {
// TODO check malicious data: - e.g. data:script
if scheme == "data:" {
return string(uri), nil
if bytes.HasPrefix(uri, []byte("data:image/png")) ||
bytes.HasPrefix(uri, []byte("data:image/jpeg")) ||
bytes.HasPrefix(uri, []byte("data:image/pjpeg")) ||
bytes.HasPrefix(uri, []byte("data:image/gif")) ||
bytes.HasPrefix(uri, []byte("data:image/webp")) {
// should be safe
return string(uri), nil
} else {
// unsafe data
return "", nil
}
}
// parse the uri