Publicētais avots

CH-J Server Manager

Pārlūkot mapes un failus konkrētai lietojumprogrammas izdošanai.

Lejupielādēt avota ZIP

CH-J / Server Manager 193 faili

core-20261011T184039Z-4148710795d0 Pievienots: Datums nav reģistrēts · Būvēts: 2026. gada 11. okt. 20:40

urlPolicy.js Pievienots: Datums nav reģistrēts 1,5 KB · 40 rindas

Lejupielādēt failu

1"use strict";

3function normalizeBaseUrl(value) {

4 const url = new URL(String(value || ""));

5 if (url.protocol !== "https:") throw new Error("Update URL must use HTTPS.");

6 if (url.username || url.password || url.hash || url.search) throw new Error("Invalid update base URL.");

7 url.pathname = `${url.pathname.replace(/\/+$/, "")}/`;

8 return url;

9}

11function assertAllowedUrl(candidate, allowedBaseUrls, options = {}) {

12 const raw = String(candidate || "").trim();

13 if (!raw) throw new Error("Missing URL.");

14 const bases = allowedBaseUrls.map(normalizeBaseUrl);

16 if (raw.startsWith("/")) {

17 if (!options.baseUrl) throw new Error("Relative URL requires a base URL.");

    return assertAllowedUrl(new URL(raw.replace(/^\/+/, ""), normalizeBaseUrl(options.baseUrl)).toString(), allowedBaseUrls, options);

19 }

21 const url = new URL(raw);

22 if (url.username || url.password || url.hash) throw new Error("URL credentials and fragments are not allowed.");

23 const matchedBase = bases.find((base) => (

24 url.protocol === base.protocol

25 && url.hostname === base.hostname

26 && url.port === base.port

27 && url.pathname.startsWith(base.pathname)

28 ));

29 if (!matchedBase) throw new Error("URL is outside the update allowlist.");

31 if (options.pathSegment && !url.pathname.startsWith(`${matchedBase.pathname}${options.pathSegment}`)) {

32 throw new Error("URL path is outside the allowed update area.");

33 }

34 return url;

35}

37module.exports = {

38 assertAllowedUrl,

39 normalizeBaseUrl

40};

SHA-256

db15c1e8b5a134391637a8de3efca895dcbf77095a5eaf58acba061b69775030

CH-J Proprietary Software License 1.14 · Avots ir sniegts saskaņā ar CH-J Proprietary Software License 1.14. Tā pieejamība nemaina licences noteikumus un nepiešķir papildu tiesības.

Arhīvs SHA-256

5a8ea02d06a5643cf2330fe9f54b8767a06c1c59d36527705e536fa9dbca7614