mirror of
https://github.com/karl0ss/homepage.git
synced 2025-05-03 05:53:40 +01:00

* Restrict emby endpoints and proxy segments * Dont allow path traversal in segments * Restrict qbittorrent proxy endpoints * Restrict npm proxy endpoints * Restrict flood proxy endpoints * Restrict tdarr proxy endpoints * Restrict xteve proxy endpoints * Restrict transmission proxy endpoints * disallow non-mapped endpoints this change drops all requests that have un-mapped endpoint queries allowedEndpoints is added as a method to pass proxy requests via a regex on the endpoint most widgets with custom proxies use either no endpoint, or a static one Co-Authored-By: Ben Phelps <ben@phelps.io>
60 lines
1.6 KiB
JavaScript
60 lines
1.6 KiB
JavaScript
export function formatApiCall(url, args) {
|
|
const find = /\{.*?\}/g;
|
|
const replace = (match) => {
|
|
const key = match.replace(/\{|\}/g, "");
|
|
return args[key] || "";
|
|
};
|
|
|
|
return url.replace(/\/+$/, "").replace(find, replace).replace(find, replace);
|
|
}
|
|
|
|
export function getURLSearchParams(widget, endpoint) {
|
|
const params = new URLSearchParams({
|
|
type: widget.type,
|
|
group: widget.service_group,
|
|
service: widget.service_name,
|
|
});
|
|
if (endpoint) {
|
|
params.append("endpoint", endpoint);
|
|
}
|
|
return params;
|
|
}
|
|
|
|
export function formatProxyUrl(widget, endpoint, queryParams) {
|
|
const params = getURLSearchParams(widget, endpoint);
|
|
if (queryParams) {
|
|
params.append("query", JSON.stringify(queryParams));
|
|
}
|
|
return `/api/services/proxy?${params.toString()}`;
|
|
}
|
|
|
|
export function asJson(data) {
|
|
if (data?.length > 0) {
|
|
const json = JSON.parse(data.toString());
|
|
return json;
|
|
}
|
|
return data;
|
|
}
|
|
|
|
export function jsonArrayTransform(data, transform) {
|
|
const json = asJson(data);
|
|
if (json instanceof Array) {
|
|
return transform(json);
|
|
}
|
|
return json;
|
|
}
|
|
|
|
export function jsonArrayFilter(data, filter) {
|
|
return jsonArrayTransform(data, (items) => items.filter(filter));
|
|
}
|
|
|
|
export function sanitizeErrorURL(errorURL) {
|
|
// Dont display sensitive params on frontend
|
|
const url = new URL(errorURL);
|
|
["apikey", "api_key", "token", "t", "access_token", "auth"].forEach((key) => {
|
|
if (url.searchParams.has(key)) url.searchParams.set(key, "***");
|
|
if (url.hash.includes(key)) url.hash = url.hash.replace(new RegExp(`${key}=[^&]+`), `${key}=***`);
|
|
});
|
|
return url.toString();
|
|
}
|