SSRF vulnerability

[fluix-dev]

Reporting in the public because this got added 1 hour ago and I don't believe this site is deployed publicly.

I'm pretty sure #93 adds an SSRF vulnerability in the addUnsplashPicture handler here:

url = request.POST["url"]
url += ".jpg"
response = requests.get(url, stream=True)

The url that gets requested here is attacker controlled, with the exception of a forced .jpg being added on meaning they could request local content from 127.0.0.1 for example. I'm not actually sure where this view is used, but mitigations could be either only passing along the image ID (like photo-1547656807-9733c2b738c2) which gets appended to https://images.unsplash.com/ or check that the domain is Unsplash. You should also probably use allow_redirects=False to prevent any open redirects leading to SSRFs.

[fluix-dev]

@Gongsta bump on this because the website appears to be live.

[Gongsta]

Fixed in commit. Thanks!