e241b99d22
All checks were successful
check / check (push) Successful in 1m50s
Signatures are per-URL, so the whitelist should only support exact host matches. Remove the suffix/wildcard matching that allowed patterns like '.example.com' to bypass signature requirements for entire domain trees. Leading dots in existing config entries are now stripped, so '.example.com' becomes 'example.com' as an exact match (backwards-compatible normalisation).
67 lines
1.6 KiB
Go
67 lines
1.6 KiB
Go
package imgcache
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// HostWhitelist checks whether a source host is allowed without a signature.
|
|
// Only exact host matches are supported. Signatures are per-URL, so
|
|
// wildcard/suffix matching is intentionally not provided.
|
|
type HostWhitelist struct {
|
|
// exactHosts contains hosts that must match exactly (e.g., "cdn.example.com")
|
|
exactHosts map[string]struct{}
|
|
}
|
|
|
|
// NewHostWhitelist creates a whitelist from a list of hostnames.
|
|
// Each entry is treated as an exact host match. Leading dots are
|
|
// stripped so that legacy ".example.com" entries become "example.com".
|
|
func NewHostWhitelist(patterns []string) *HostWhitelist {
|
|
w := &HostWhitelist{
|
|
exactHosts: make(map[string]struct{}),
|
|
}
|
|
|
|
for _, pattern := range patterns {
|
|
pattern = strings.ToLower(strings.TrimSpace(pattern))
|
|
if pattern == "" {
|
|
continue
|
|
}
|
|
|
|
// Strip leading dot — suffix matching is no longer supported;
|
|
// ".example.com" is normalised to "example.com" as an exact entry.
|
|
pattern = strings.TrimPrefix(pattern, ".")
|
|
|
|
if pattern != "" {
|
|
w.exactHosts[pattern] = struct{}{}
|
|
}
|
|
}
|
|
|
|
return w
|
|
}
|
|
|
|
// IsWhitelisted checks if a URL's host is in the whitelist (exact match only).
|
|
func (w *HostWhitelist) IsWhitelisted(u *url.URL) bool {
|
|
if u == nil {
|
|
return false
|
|
}
|
|
|
|
host := strings.ToLower(u.Hostname())
|
|
if host == "" {
|
|
return false
|
|
}
|
|
|
|
_, ok := w.exactHosts[host]
|
|
|
|
return ok
|
|
}
|
|
|
|
// IsEmpty returns true if the whitelist has no entries.
|
|
func (w *HostWhitelist) IsEmpty() bool {
|
|
return len(w.exactHosts) == 0
|
|
}
|
|
|
|
// Count returns the total number of whitelist entries.
|
|
func (w *HostWhitelist) Count() int {
|
|
return len(w.exactHosts)
|
|
}
|