Private
Public Access
ksmithandClaude Sonnet 5
760d2cf5dd
Slack/Discord-style link unfurling: the first http(s) URL in a message's content gets a small preview card (title/description/image/site name) fetched from the page's Open Graph tags. Backend: - Message.preview_url (extracted at create/edit time, cheap regex, no I/O) points at a link_previews cache row keyed by URL -- the same URL posted in different messages/rooms fetches once, and a failed fetch is cached too so a dead URL isn't retried on every reference. - The actual fetch runs in a background asyncio.create_task from broadcast_new_message/broadcast_message_update, on its own DB session, so a slow third-party site never delays message delivery. A separate "link_preview" WS envelope carries the result once it resolves. - SSRF protection reuses app/services/ssrf.py's validate_target_url (renamed from UnsafeWebhookUrlError to UnsafeUrlError now that it's shared with webhooks), but re-validates before every hop of a redirect chain rather than once up front -- redirects are followed manually so each intermediate URL is checked before it's ever connected to. - Parsed with stdlib html.parser -- no new dependency. Frontend: a LinkPreviewCard rendered under message content when present, patched into state live via the new WS envelope and included in message history for reloads. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
42 lines
1.3 KiB
Python
42 lines
1.3 KiB
Python
import ipaddress
|
|
import socket
|
|
from urllib.parse import urlparse
|
|
|
|
|
|
class UnsafeUrlError(Exception):
|
|
pass
|
|
|
|
|
|
def validate_target_url(url: str) -> None:
|
|
"""One-shot SSRF check: rejects non-http(s) schemes and any target whose
|
|
hostname resolves to a private/loopback/link-local/reserved/multicast
|
|
address. Shared by two callers with different re-check needs: webhook
|
|
subscriptions validate once at creation time and reuse the URL for many
|
|
future deliveries (a real but accepted DNS-rebinding gap, documented
|
|
here), while link_preview_service calls this fresh before *every* hop of
|
|
a redirect chain for a one-shot fetch, which closes that gap for its own
|
|
use case.
|
|
"""
|
|
parsed = urlparse(url)
|
|
if parsed.scheme not in ("http", "https"):
|
|
raise UnsafeUrlError()
|
|
if not parsed.hostname:
|
|
raise UnsafeUrlError()
|
|
|
|
try:
|
|
addrinfo = socket.getaddrinfo(parsed.hostname, None)
|
|
except socket.gaierror as exc:
|
|
raise UnsafeUrlError() from exc
|
|
|
|
for *_rest, sockaddr in addrinfo:
|
|
ip = ipaddress.ip_address(sockaddr[0])
|
|
if (
|
|
ip.is_private
|
|
or ip.is_loopback
|
|
or ip.is_link_local
|
|
or ip.is_reserved
|
|
or ip.is_multicast
|
|
or ip.is_unspecified
|
|
):
|
|
raise UnsafeUrlError()
|