fix: add more domain validation to login page

thilobillerbeck · Nov 27, 2024 · db8fae4 · db8fae4
1 parent 75a422d
commit db8fae4
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/lib/utils.ts b/lib/utils.ts
@@ -32,6 +32,10 @@ export function domainToUrl(domain: string) {
     return `https://${domain}`
 }
 
+export function validateDomain(domain: string) {
+    return domain.match(/(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]/g)
+}
+
 export function genCallBackUrl(instanceDomain: string) {
     if (process.env.NODE_ENV == 'development') {
         const { ADDRESS = 'localhost', PORT = '3000' } = process.env;

diff --git a/routes/user.ts b/routes/user.ts
@@ -1,6 +1,6 @@
 import { FastifyInstance } from "fastify";
 import { Mastodon } from 'megalodon'
-import { authenticateJWT, domainToUrl, genCallBackUrl } from './../lib/utils'
+import { authenticateJWT, domainToUrl, genCallBackUrl, validateDomain } from './../lib/utils'
 import { db, getInstanceByDomain, getUserByMastodonUid } from './../lib/db'
 import { AtpSessionData } from "@atproto/api";
 
@@ -70,7 +70,14 @@ export const routesUser = async (app: FastifyInstance, options: Object) => {
         }
     }>('/auth', async (req, res) => {
         let instanceDomain: string = req.query.instance || "mastodon.social"
-        instanceDomain = instanceDomain.toLowerCase().replace(/https?:\/\//, "")
+        instanceDomain = instanceDomain.toLowerCase().replace(/https?:\/\//, "").replace("/", "")
+
+        if(!validateDomain(instanceDomain)) {
+            return res.status(400).view("login", {
+                err: 'Invalid instance domain'
+            })
+        }
+
         const url = domainToUrl(instanceDomain)
         let client = new Mastodon(url)