Validate import URLs

Author: Js41637

src/api/gi/wishes_import/mod.rs

@@ -16,7 +16,7 @@ use utoipa::{OpenApi, ToSchema};
 use crate::{
     api::{
         banner_helpers::{self, GI_STANDARD},
-        ApiResult,
+        validate_import_url, ApiResult,
     },
     database, GiGachaType,
 };
@@ -106,6 +106,7 @@ struct WishesImport {
     request_body = WishesImportParams,
     responses(
         (status = 200, description = "WishesImport", body = WishesImport),
+        (status = 400, description = "Invalid URL"),
     )
 )]
 #[post("/api/gi/wishes-import")]
@@ -115,7 +116,10 @@ async fn post_gi_wishes_import(
     wishes_import_infos: web::Data<WishesImportInfos>,
     pool: web::Data<PgPool>,
 ) -> ApiResult<impl Responder> {
-    let url = Url::parse(&params.url)?;
+    let url = match validate_import_url(&params.url) {
+        Ok(url) => url,
+        Err(response) => return Ok(response),
+    };
 
     let query = url.query_pairs().filter(|(name, _)| {
         matches!(

src/api/mod.rs

@@ -27,11 +27,12 @@ use std::env;
 
 use crate::app_config::AppConfig;
 use actix_multipart::form::{tempfile::TempFile, MultipartForm};
-use actix_web::{guard, web};
+use actix_web::{guard, web, HttpResponse};
 use serde::{Deserialize, Serialize};
 use sqlx::PgPool;
 use std::sync::Arc;
 use strum::{Display, EnumString};
+use url::Url;
 use utoipa::{
     openapi::security::{ApiKey, ApiKeyValue, SecurityScheme},
     IntoParams, Modify, OpenApi, ToSchema,
@@ -41,6 +42,18 @@ use crate::{Difficulty, GachaType, GiGachaType, Language, ZzzGachaType};
 
 type ApiResult<T> = Result<T, Box<dyn std::error::Error>>;
 
+pub(crate) fn validate_import_url(raw_url: &str) -> Result<Url, HttpResponse> {
+    let Ok(url) = Url::parse(raw_url) else {
+        return Err(HttpResponse::BadRequest().body("Invalid URL"));
+    };
+
+    if !matches!(url.scheme(), "http" | "https") || url.host_str().is_none() {
+        return Err(HttpResponse::BadRequest().body("Invalid URL"));
+    }
+
+    Ok(url)
+}
+
 #[derive(OpenApi)]
 #[openapi(tags((name = "pinned")), components(schemas(Language, GachaType, ZzzGachaType, GiGachaType, File, Difficulty)), modifiers(&PrivateAddon))]
 struct ApiDoc;

src/api/warps_import/mod.rs

@@ -15,7 +15,7 @@ use utoipa::{OpenApi, ToSchema};
 use crate::{
     api::{
         banner_helpers::{self, HSR_STANDARD},
-        ApiResult,
+        validate_import_url, ApiResult,
     },
     database, mihomo, GachaType, Language,
 };
@@ -106,6 +106,7 @@ struct WarpsImport {
     request_body = WarpsImportParams,
     responses(
         (status = 200, description = "WarpsImport", body = WarpsImport),
+        (status = 400, description = "Invalid URL"),
     )
 )]
 #[post("/api/warps-import")]
@@ -115,7 +116,10 @@ async fn post_warps_import(
     warps_import_infos: web::Data<WarpsImportInfos>,
     pool: web::Data<PgPool>,
 ) -> ApiResult<impl Responder> {
-    let original_url = Url::parse(&params.url)?;
+    let original_url = match validate_import_url(&params.url) {
+        Ok(url) => url,
+        Err(response) => return Ok(response),
+    };
 
     let mut uid = None;
 

src/api/zzz/signals_import/mod.rs

@@ -12,7 +12,10 @@ use strum::IntoEnumIterator;
 use url::Url;
 use utoipa::{OpenApi, ToSchema};
 
-use crate::{api::ApiResult, database, ZzzGachaType};
+use crate::{
+    api::{validate_import_url, ApiResult},
+    database, ZzzGachaType,
+};
 
 #[derive(OpenApi)]
 #[openapi(
@@ -98,6 +101,7 @@ struct SignalsImport {
     request_body = SignalsImportParams,
     responses(
         (status = 200, description = "SignalsImport", body = SignalsImport),
+        (status = 400, description = "Invalid URL"),
     )
 )]
 #[post("/api/zzz/signals-import")]
@@ -107,7 +111,10 @@ async fn post_zzz_signals_import(
     signals_import_infos: web::Data<SignalsImportInfos>,
     pool: web::Data<PgPool>,
 ) -> ApiResult<impl Responder> {
-    let url = Url::parse(&params.url)?;
+    let url = match validate_import_url(&params.url) {
+        Ok(url) => url,
+        Err(response) => return Ok(response),
+    };
 
     let query = url.query_pairs().filter(|(name, _)| {
         matches!(