AI_Slop/sc-postiz-poster
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security audit.

Browse source
This commit is contained in:
Scott Duensing 2026-06-24 20:22:55 -05:00
parent 3b55965c15
commit 8742d02022
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
lib/postizClient.js
View file

@ -10,6 +10,18 @@ const makePostizClient = (pluginCfg) => {
const apiKey = String((pluginCfg && pluginCfg.apiKey) || ""); const apiKey = String((pluginCfg && pluginCfg.apiKey) || "");
const request = async (method, endpoint, body) => { const request = async (method, endpoint, body) => {
// Guard the operator-set baseUrl before we ever send the sealed apiKey:
// reject unparseable / non-http(s) schemes (file:, gopher:, data:, ...).
// Private/self-hosted hosts are allowed by design (self-hosted Postiz).
let parsed;
try {
parsed = new URL(baseUrl);
} catch (e) {
throw new Error(`Postiz baseUrl is not a valid URL: ${baseUrl}`);
}
if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
throw new Error(`Postiz baseUrl must use http or https: ${baseUrl}`);
}
const url = `${baseUrl}${PATH_BASE}${endpoint}`; const url = `${baseUrl}${PATH_BASE}${endpoint}`;
const headers = { [AUTH_HEADER]: apiKey }; const headers = { [AUTH_HEADER]: apiKey };
const init = { method, headers }; const init = { method, headers };