From d7830f4bfc79cb0dbd7c507263813a8e19083a41 Mon Sep 17 00:00:00 2001 From: maxlajoie99 Date: Fri, 27 Dec 2024 20:26:55 -0500 Subject: [PATCH 1/2] Experimental proxy support by manually following redirects --- server/Server.js | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/server/Server.js b/server/Server.js index 46850cbb..9bbdb486 100644 --- a/server/Server.js +++ b/server/Server.js @@ -6,6 +6,7 @@ const util = require('util') const fs = require('./libs/fsExtra') const fileUpload = require('./libs/expressFileupload') const cookieParser = require('cookie-parser') +const axios = require('axios') const { version } = require('../package.json') @@ -54,7 +55,25 @@ class Server { global.XAccel = process.env.USE_X_ACCEL global.AllowCors = process.env.ALLOW_CORS === '1' - if (process.env.DISABLE_SSRF_REQUEST_FILTER === '1') { + if (process.env.EXP_PROXY_SUPPORT === '1') { + Logger.info(`[Server] Experimental Proxy Support Enabled, SSRF Request Filter was Disabled`); + global.DisableSsrfRequestFilter = () => true + + axios.defaults.maxRedirects = 0; + axios.interceptors.response.use( + response => response, + error => { + if ([301, 302].includes(error.response?.status)) { + return axios({ + ...error.config, + url: error.response.headers.location, + }); + } + + return Promise.reject(error); + } + ); + } else if (process.env.DISABLE_SSRF_REQUEST_FILTER === '1') { Logger.info(`[Server] SSRF Request Filter Disabled`) global.DisableSsrfRequestFilter = () => true } else if (process.env.SSRF_REQUEST_FILTER_WHITELIST?.length) { From f3918a47e14160ce02c79364cc8c04d10023b8c0 Mon Sep 17 00:00:00 2001 From: advplyr Date: Wed, 1 Jan 2025 12:48:58 -0600 Subject: [PATCH 2/2] Auto formatting --- server/Server.js | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/server/Server.js b/server/Server.js index 9bbdb486..e9e77f00 100644 --- a/server/Server.js +++ b/server/Server.js @@ -56,23 +56,24 @@ class Server { global.AllowCors = process.env.ALLOW_CORS === '1' if (process.env.EXP_PROXY_SUPPORT === '1') { - Logger.info(`[Server] Experimental Proxy Support Enabled, SSRF Request Filter was Disabled`); + // https://github.com/advplyr/audiobookshelf/pull/3754 + Logger.info(`[Server] Experimental Proxy Support Enabled, SSRF Request Filter was Disabled`) global.DisableSsrfRequestFilter = () => true - - axios.defaults.maxRedirects = 0; + + axios.defaults.maxRedirects = 0 axios.interceptors.response.use( - response => response, - error => { + (response) => response, + (error) => { if ([301, 302].includes(error.response?.status)) { return axios({ ...error.config, - url: error.response.headers.location, - }); + url: error.response.headers.location + }) } - - return Promise.reject(error); + + return Promise.reject(error) } - ); + ) } else if (process.env.DISABLE_SSRF_REQUEST_FILTER === '1') { Logger.info(`[Server] SSRF Request Filter Disabled`) global.DisableSsrfRequestFilter = () => true