Chat Federation, avoid spoofing:

When sanitizing remote informations, we check that urls and hosts are on the correct domain or subdomain.
2023-05-31 16:19:45 +02:00
parent 4faf8a3aea
commit 743c4eabd9
4 changed files with 99 additions and 19 deletions
--- a/server/lib/federation/fetch-infos.ts
+++ b/server/lib/federation/fetch-infos.ts
@ -80,7 +80,7 @@ async function fetchMissingRemoteServerInfos (
      return
    }

-    const serverInfos = sanitizePeertubeLiveChatServerInfos(options, response)
+    const serverInfos = sanitizePeertubeLiveChatServerInfos(options, response, remoteInstanceUrl)
    if (serverInfos) {
      await storeRemoteServerInfos(options, serverInfos)
    }