🐛 fix: prevent SSRF attacks

pages/api/database/recipe/structured-data.ts

@@ -61,29 +61,17 @@ const handleGET = async (
   res: NextApiResponse,
   session?: Session,
 ) => {
-  const url = req.query.url
+  const content = req.query.content
 
-  if (!url || typeof url !== 'string') {
+  if (!content || typeof content !== 'string') {
     res.status(400).json({
       ok: false,
-      message: "'url' is not valid",
+      message: "'content' is not valid",
     })
     return
   }
 
-  const response = await axios.get(url)
-
-  // Extract the structured data from the response
-
-  if (!response.headers['content-type'].includes('text/html')) {
-    res.status(400).json({
-      ok: false,
-      message: 'The url does not link to a website',
-    })
-    return
-  }
-
-  const parsedRecipe = await parseHTML(response.data)
+  const parsedRecipe = await parseHTML(content)
 
   if (typeof parsedRecipe === 'string') {
     throw new Error(parsedRecipe)

pages/recipe/create.tsx

@@ -20,6 +20,7 @@ import {
   Typography,
 } from '@mui/material'
 import { Recipe, RecipeImage, RecipeIngredient } from '@prisma/client'
+import axios from 'axios'
 import { GetStaticProps } from 'next'
 import { useSession } from 'next-auth/react'
 import { useTranslation } from 'next-i18next'
@@ -142,18 +143,26 @@ const CreateRecipePage: FC = () => {
 
   const handleImportSubmit = () => {
     toast.promise(
-      api.get<
-        YKResponse<
-          Recipe & {
-            ingredients: RecipeIngredient[]
-            image: (RecipeImage & { file?: File })[]
-          }
-        >
-      >('database/recipe/structured-data', {
-        params: {
-          url: importUrl,
-        },
-      }),
+      async () => {
+        // We do this client side to prevent SSRF attacks
+        const contentResponse = await axios.get(importUrl, {
+          headers: {
+            Accept: 'text/html',
+          },
+        })
+        return api.get<
+          YKResponse<
+            Recipe & {
+              ingredients: RecipeIngredient[]
+              image: (RecipeImage & { file?: File })[]
+            }
+          >
+        >('database/recipe/structured-data', {
+          params: {
+            content: contentResponse.data,
+          },
+        })
+      },
       {
         loading: t('importing_recipe'),
         error: (err) => err.message ?? err,