Merge pull request #74 from sakura-tel/sakura-tel/develop

Release 2022.07.03-milkey-3.0

locales/en-US.yml

@@ -878,6 +878,7 @@ createdAt: "Created at"
 invitationRequiredToRegister: "This server is currently invitation only. Only those with an invitation code can register."
 themeColor: "Theme Color"
 preferTickerSoftwareColor: "Prefer Software Color on instance ticker"
+typeToConfirm: "Please enter {x} to confirm"
 
 _template:
   edit: "Edit Template..."

locales/ja-JP.yml

@@ -918,6 +918,7 @@ leaveGroupConfirm: "「{name}」から抜けますか？"
 notSpecifiedMentionWarning: "宛先に含まれていないメンションがあります"
 themeColor: "テーマカラー"
 preferTickerSoftwareColor: "インスタンスティッカーにソフトウェアカラーを採用して表示する"
+typeToConfirm: "この操作を行うには {x} と入力してください"
 
 _template:
   edit: "定型文を編集…"

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "groundpolis-milkey",
-	"version": "2022.07.03-milkey-2.9",
+	"version": "2022.07.03-milkey-3.0",
 	"private": true,
 	"author": "Xeltica <xeltica@gmail.com> , Minemu <minemu398@outlook.jp> , Azuki⪥ <cluikeit_31701@outlook.com> , Remito <remitocat@gmail.com> , atsu1125 <atsuchan@atsuchan.page>",
 	"contributors": [

src/client/pages/instance/user-dialog.vue

@@ -62,6 +62,7 @@ import XModalWindow from '@/components/ui/modal-window.vue';
 import Progress from '@/scripts/loading';
 import { acct, userPage } from '../../filters/user';
 import * as os from '@/os';
+import { i18n } from '@/i18n';
 
 export default defineComponent({
 	components: {
@@ -223,16 +224,30 @@ export default defineComponent({
 				text: this.$ts.deleteAccountConfirm,
 			});
 			if (confirm.canceled) return;
-			const process = async () => {
-				await os.api('admin/delete-account', { userId: this.user.id });
-				os.success();
-			};
-			await process().catch(e => {
+			const { canceled, result: username } = await os.dialog({
+				title: i18n.t('typeToConfirm', { x: this.user?.username }),
+				input: {
+					allowEmpty: false
+				}
+			});
+			if (canceled) return;
+			if (username === this.user?.username) {
+				const process = async () => {
+					await os.api('admin/delete-account', { userId: this.user.id });
+					os.success();
+				};
+				await process().catch(e => {
+					os.dialog({
+						type: 'error',
+						text: e.toString()
+					});
+				});
+			} else {
 				os.dialog({
 					type: 'error',
-					text: e.toString()
+					text: 'input not match',
 				});
-			});
+			}
 			await this.refreshUser();
 		},
 

src/client/pages/mfm-cheat-sheet.vue

@@ -33,7 +33,7 @@ export default defineComponent({
 				[ 'hashtag', '#test' ],
 				[ 'url', `https://example.com` ],
 				[ 'link', `[${this.$ts._mfm.dummy}](https://example.com)` ],
-				[ 'emoji', `:${this.$instance.emojis[0].name}:` ],
+				[ 'emoji', this.$instance.emojis.length ? `:${this.$instance.emojis[0].name}:` : `:emojiname:` ],
 				[ 'userEmoji', `:@${this.$i.username}:` ],
 				[ 'bold', `**${this.$ts._mfm.dummy}**` ],
 				[ 'small', `<small>${this.$ts._mfm.dummy}</small>` ],

src/misc/convert-host.ts

@@ -10,6 +10,16 @@ export function isSelfHost(host: string) {
 	return toPuny(config.host) === toPuny(host);
 }
 
+export function isSelfOrigin(src: unknown) {
+	if (typeof src !== 'string') return null;
+	try {
+		const u = new URL(src);
+		return u.origin === config.url;
+	} catch {
+		return false;
+	}
+}
+
 export function extractDbHost(uri: string) {
 	const url = new URL(uri);
 	return toPuny(url.hostname);

src/misc/download-url.ts

@@ -8,10 +8,15 @@ import * as chalk from 'chalk';
 import Logger from '../services/logger';
 import * as IPCIDR from 'ip-cidr';
 const PrivateIp = require('private-ip');
+import { isValidUrl } from './is-valid-url';
 
 const pipeline = util.promisify(stream.pipeline);
 
 export async function downloadUrl(url: string, path: string) {
+	if (!isValidUrl(url)) {
+		throw new StatusError('Invalid URL', 400);
+	}
+
 	const logger = new Logger('download');
 
 	logger.info(`Downloading ${chalk.cyan(url)} ...`);
@@ -20,29 +25,39 @@ export async function downloadUrl(url: string, path: string) {
 	const operationTimeout = 60 * 1000;
 	const maxSize = config.maxFileSize || 262144000;
 
-	const req = got.stream(url, {
-		headers: {
-			'User-Agent': config.userAgent
-		},
-		timeout: {
-			lookup: timeout,
-			connect: timeout,
-			secureConnect: timeout,
-			socket: timeout,	// read timeout
-			response: timeout,
-			send: timeout,
-			request: operationTimeout,	// whole operation timeout
-		},
-		agent: {
-			http: httpAgent,
-			https: httpsAgent,
-		},
-		http2: false,	// default
-		retry: 0,
-	}).on('response', (res: Got.Response) => {
-		if ((process.env.NODE_ENV === 'production' || process.env.NODE_ENV === 'test') && !config.proxy && res.ip) {
-			if (isPrivateIp(res.ip)) {
-				logger.warn(`Blocked address: ${res.ip}`);
+	const req = got
+		.stream(url, {
+			headers: {
+				'User-Agent': config.userAgent,
+			},
+			timeout: {
+				lookup: timeout,
+				connect: timeout,
+				secureConnect: timeout,
+				socket: timeout,	// read timeout
+				response: timeout,
+				send: timeout,
+				request: operationTimeout,	// whole operation timeout
+			},
+			agent: {
+				http: httpAgent,
+				https: httpsAgent,
+			},
+			http2: false,	// default
+			retry: {
+				limit: 0,
+			},
+		})
+		.on('redirect', (res: Got.Response, opts: Got.NormalizedOptions) => {
+			if (!isValidUrl(opts.url)) {
+				logger.warn(`Invalid URL: ${opts.url}`);
+				req.destroy();
+			}
+		})
+		.on('response', (res: Got.Response) => {
+			if ((process.env.NODE_ENV === 'production' || process.env.NODE_ENV === 'test') && !config.proxy && res.ip) {
+				if (isPrivateIp(res.ip)) {
+					logger.warn(`Blocked address: ${res.ip}`);
 				req.destroy();
 			}
 		}

src/misc/fetch.ts

@@ -1,10 +1,11 @@
 import * as http from 'http';
 import * as https from 'https';
 import CacheableLookup from 'cacheable-lookup';
-import fetch from 'node-fetch';
+import fetch, { RequestRedirect } from 'node-fetch';
 import { HttpProxyAgent, HttpsProxyAgent } from 'hpagent';
 import config from '../config';
 import { URL } from 'url';
+import { isValidUrl } from './is-valid-url';
 
 export async function getJson(url: string, accept = 'application/json, */*', timeout = 10000, headers?: Record<string, string>) {
 	const res = await getResponse({
@@ -34,8 +35,20 @@ export async function getHtml(url: string, accept = 'text/html, */*', timeout =
 	return await res.text();
 }
 
-export async function getResponse(args: { url: string, method: string, body?: string, headers: Record<string, string>, timeout?: number, size?: number }) {
-	const timeout = args?.timeout || 10 * 1000;
+export async function getResponse(args: {
+	url: string;
+	method: string;
+	body?: string;
+	headers: Record<string, string>;
+	timeout?: number;
+	size?: number;
+	redirect?: RequestRedirect;
+}) {
+	if (!isValidUrl(args.url)) {
+		throw new StatusError('Invalid URL', 400);
+	}
+
+	const timeout = args.timeout || 10 * 1000;
 
 	const controller = new AbortController();
 	setTimeout(() => {
@@ -50,8 +63,16 @@ export async function getResponse(args: { url: string, method: string, body?: st
 		size: args?.size || 10 * 1024 * 1024,
 		agent: getAgentByUrl,
 		signal: controller.signal,
+		redirect: args.redirect,
 	});
 
+	if (args.redirect === 'manual' && [301, 302, 307, 308].includes(res.status)) {
+		if (!isValidUrl(res.url)) {
+			throw new StatusError('Invalid URL', 400);
+		}
+		return res;
+	}
+
 	if (!res.ok) {
 		throw new StatusError(`${res.status} ${res.statusText}`, res.status, res.statusText);
 	}

src/misc/is-valid-url.ts

@@ -0,0 +1,20 @@
+export function isValidUrl(url: string | URL | undefined): boolean {
+	if (process.env.NODE_ENV !== 'production') return true;
+
+	try {
+		if (url == null) return false;
+
+		const u = typeof url === 'string' ? new URL(url) : url;
+		if (!u.protocol.match(/^https?:$/) || u.hostname === 'unix') {
+			return false;
+		}
+
+		if (u.port !== '' && !['80', '443'].includes(u.port)) {
+			return false;
+		}
+
+		return true;
+	} catch {
+		return false;
+	}
+}