Invario/Inventarsystem
3
1
Fork 0
Code Issues 29 Pull Requests Actions Packages Projects Releases 218 Wiki Activity

Debug removal of whitelist
Release Inventarsystem / release-docker (push) Successful in 2m14s
Details

Browse Source
This commit is contained in:
AIIrondev
2026-08-12 22:38:07 +02:00
parent cfec33b362
commit 057c517515
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Web/app.py
+4 -3
View File
@@ -474,7 +474,8 @@ ALLOWED_COVER_DOMAINS = {
"covers.openlibrary.org", "covers.openlibrary.org",
"openlibrary.org", "openlibrary.org",
"lobid.org", "lobid.org",
"www.googleapis.com" "www.googleapis.com",
"www.westermann.de"
} }
SENSITIVE_AUDIT_FIELDS = ["email", "username", "full_name", "phone", "borrower", "ip"] SENSITIVE_AUDIT_FIELDS = ["email", "username", "full_name", "phone", "borrower", "ip"]
@@ -10043,8 +10044,8 @@ def download_book_cover():
return jsonify({"error": "Only public HTTPS URLs are allowed"}), 400 return jsonify({"error": "Only public HTTPS URLs are allowed"}), 400
# 2. SSRF Protection: Strict Allowlist Check # 2. SSRF Protection: Strict Allowlist Check
if parsed_url.netloc not in ALLOWED_COVER_DOMAINS: # if parsed_url.netloc not in ALLOWED_COVER_DOMAINS: # ---------------------------------------------- has to be implementet at a laterstage ---------------------------------------------------------------
return jsonify({"error": "Target host is not an allowed book cover provider"}), 403 # return jsonify({"error": "Target host is not an allowed book cover provider"}), 403
# Download the image (allow_redirects=False prevents redirecting to internal IPs) # Download the image (allow_redirects=False prevents redirecting to internal IPs)
response = requests.get(image_url, stream=True, timeout=10, allow_redirects=False) response = requests.get(image_url, stream=True, timeout=10, allow_redirects=False)