admin/windwiderstand
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix FilesBlock: external URLs bypass /cms-files proxy

Browse Source 
getCmsFileUrl() returned /cms-files?src=... for all URLs including
external ones. resolveCmsSource() rejects foreign hosts (SSRF guard),
so external file links 404'd. External http(s) URLs now returned directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Peter Meier
2026-05-18 08:36:43 +02:00
parent 44b991f7c1
commit 4b9214dbaf
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/rusty-file.ts
+5
View File
@@ -62,8 +62,13 @@ export interface CmsFileUrlOptions {
/** /**
* Lokale Datei-URL: /cms-files?src=…&name=…&dl=… * Lokale Datei-URL: /cms-files?src=…&name=…&dl=…
* `src` = volle Datei-URL oder CMS-Asset-Pfad (`/api/assets/...`). * `src` = volle Datei-URL oder CMS-Asset-Pfad (`/api/assets/...`).
* Externe http(s)-URLs werden direkt zurückgegeben — der /cms-files-Proxy
* würde sie wegen SSRF-Schutz sowieso ablehnen.
*/ */
export function getCmsFileUrl(src: string, opts: CmsFileUrlOptions = {}): string { export function getCmsFileUrl(src: string, opts: CmsFileUrlOptions = {}): string {
if (src.startsWith('http://') || src.startsWith('https://')) {
return src;
}
const params = new URLSearchParams(); const params = new URLSearchParams();
params.set('src', src); params.set('src', src);
if (opts.filename) params.set('name', opts.filename); if (opts.filename) params.set('name', opts.filename);