From 9ad733614f9de494ff952b9c9f72b834bfb8252b Mon Sep 17 00:00:00 2001
From: cel <cel@lOUVT+Phkvai9a/cCS/RKo+S9hnPAQdVixms/7ldpPA=.ed25519>
Date: Sat, 28 Mar 2020 15:58:43 -0400
Subject: Restrict access based on Referer

---
 lib/serve.js | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

(limited to 'lib/serve.js')

diff --git a/lib/serve.js b/lib/serve.js
index fdf24f7..414cef5 100644
--- a/lib/serve.js
+++ b/lib/serve.js
@@ -122,6 +122,19 @@ Serve.prototype.go = function () {
     Boolean(conf.replyMentionFeeds)
 
   if (this.req.method === 'POST' || this.req.method === 'PUT') {
+    var referer = this.req.headers.referer
+    var refererPath = this.app.getRefererPath(referer)
+    if (!refererPath) {
+      if (!referer) console.error('Missing referer')
+      else console.error('Referer not allowed: "' + referer + '"')
+      this.res.writeHead(403)
+      return this.res.end('Forbidden')
+    }
+    if (this.isUnsafePath(refererPath)) {
+      console.error('Unsafe referer path not allowed: "' + refererPath + '"')
+      this.res.writeHead(403)
+      return this.res.end('Forbidden')
+    }
     if (/^multipart\/form-data/.test(this.req.headers['content-type'])) {
       var data = {}
       var erred
@@ -213,6 +226,14 @@ Serve.prototype.go = function () {
   }
 }
 
+Serve.prototype.isUnsafePath = function (path) {
+  return typeof path !== 'string'
+    || /^&|^%26/.test(path)
+    || path.indexOf('../') !== -1
+    || path.startsWith('/web/')
+    || path.startsWith('/npm-readme/')
+}
+
 Serve.prototype.saveDraft = function (content, cb) {
   var self = this
   var data = self.data
@@ -2426,7 +2447,6 @@ Serve.prototype.wrapPage = function (title, searchQ) {
       var done = multicb({pluck: 1, spread: true})
       done()(null, h('html', h('head',
         h('meta', {charset: 'utf-8'}),
-        h('meta', {name: 'referrer', content: 'no-referrer'}),
         h('title', title),
         h('meta', {name: 'viewport', content: 'width=device-width,initial-scale=1'}),
         h('link', {rel: 'icon', href: render.toUrl('/static/hermie.ico'), type: 'image/x-icon'}),
-- 
cgit v1.2.3