Merge pull request #25 from robin-drexler/validation

valdiate urls

Author: robin-drexler

src/middleware/proxyMiddleware.js

@@ -1,10 +1,17 @@
+import { validateUrl } from "../utils/validateUrl.js";
+
 export default async (req, res, next) => {
   const proxyUrl = req.query.proxyUrl;
 
   if (!proxyUrl) {
     return next();
   }
 
+  const validation = validateUrl(proxyUrl);
+  if (!validation.valid) {
+    return res.status(400).json({ error: validation.error });
+  }
+
   req.url = proxyUrl;
   const host = new URL(proxyUrl).host;
   const headers = { ...req.headers, host };

src/middleware/redirectMiddleware.js

@@ -1,3 +1,5 @@
+import { validateUrl } from "../utils/validateUrl.js";
+
 const getRedirectUrl = (req) => {
   const referer = req.headers["referer"] || "";
   const redirectUrl = req.query.redirectUrl;
@@ -22,5 +24,11 @@ export default (req, res, next) => {
     return next();
   }
 
-  return res.redirect(301, getRedirectUrl(req));
+  const finalUrl = getRedirectUrl(req);
+  const validation = validateUrl(finalUrl);
+  if (!validation.valid) {
+    return res.status(400).json({ error: validation.error });
+  }
+
+  return res.redirect(301, finalUrl);
 };

src/tests/proxy.test.js

@@ -18,4 +18,12 @@ describe("proxy", () => {
     );
     expect(response.status).toEqual(418);
   });
+
+  it("returns 400 for invalid URL", async () => {
+    const proxyUrl = "not-a-valid-url";
+    const response = await fetch(
+      `http://localhost:3000/0?proxyUrl=${proxyUrl}`
+    );
+    expect(response.status).toEqual(400);
+  });
 });

src/tests/redirect.test.js

@@ -51,4 +51,13 @@ describe("redirecting to resources integration", () => {
     expect(response.status).toEqual(301);
     expect(response.headers.get("location")).toEqual(redirectUrl);
   });
+
+  it("returns 400 for invalid redirect URL", async () => {
+    const redirectUrl = "not-a-valid-url";
+    const response = await fetch(
+      `http://localhost:3000/0?redirectUrl=${redirectUrl}`,
+      { redirect: "manual" }
+    );
+    expect(response.status).toEqual(400);
+  });
 });

src/tests/validateUrl.test.js

@@ -0,0 +1,52 @@
+import { describe, it, expect } from "bun:test";
+import { validateUrl } from "../utils/validateUrl.js";
+
+describe("validateUrl", () => {
+  it("accepts valid http URL", () => {
+    const result = validateUrl("http://example.com");
+    expect(result.valid).toBe(true);
+    expect(result.error).toBeUndefined();
+  });
+
+  it("accepts valid https URL", () => {
+    const result = validateUrl("https://example.com/path?query=1");
+    expect(result.valid).toBe(true);
+    expect(result.error).toBeUndefined();
+  });
+
+  it("rejects empty URL", () => {
+    const result = validateUrl("");
+    expect(result.valid).toBe(false);
+    expect(result.error).toBe("URL is required");
+  });
+
+  it("rejects null URL", () => {
+    const result = validateUrl(null);
+    expect(result.valid).toBe(false);
+    expect(result.error).toBe("URL is required");
+  });
+
+  it("rejects undefined URL", () => {
+    const result = validateUrl(undefined);
+    expect(result.valid).toBe(false);
+    expect(result.error).toBe("URL is required");
+  });
+
+  it("rejects invalid URL format", () => {
+    const result = validateUrl("not-a-valid-url");
+    expect(result.valid).toBe(false);
+    expect(result.error).toBe("Invalid URL format");
+  });
+
+  it("rejects file:// protocol", () => {
+    const result = validateUrl("file:///etc/passwd");
+    expect(result.valid).toBe(false);
+    expect(result.error).toBe("URL must use http or https protocol");
+  });
+
+  it("rejects javascript: protocol", () => {
+    const result = validateUrl("javascript:alert(1)");
+    expect(result.valid).toBe(false);
+    expect(result.error).toBe("URL must use http or https protocol");
+  });
+});

src/utils/validateUrl.js

@@ -0,0 +1,23 @@
+/**
+ * Validates that a URL is a valid absolute URL with http or https protocol.
+ * @param {string} url - The URL to validate
+ * @returns {{ valid: boolean, error?: string }} - Validation result
+ */
+export function validateUrl(url) {
+  if (!url) {
+    return { valid: false, error: "URL is required" };
+  }
+
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      return {
+        valid: false,
+        error: "URL must use http or https protocol",
+      };
+    }
+    return { valid: true };
+  } catch {
+    return { valid: false, error: "Invalid URL format" };
+  }
+}