Fjerkroa/discord_bot
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

url reader: follow html meta-refresh redirects (getnews shortlinks) with ssrf re-guard

Browse Source
This commit is contained in:
Oleksandr Kozachuk
2026-07-13 20:09:46 +02:00
parent 7628faf551
commit a514ff652c
3 changed files with 93 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
specs/SPEC-011-url-reading.md
+4 -1
View File
@@ -31,7 +31,10 @@ refused without DNS.
Redirects are followed manually; each hop's target passes URL-02 and
URL-03 again. A public URL that 302-redirects to `localhost` or an
internal IP is refused at the redirect, not fetched.
internal IP is refused at the redirect, not fetched. **HTML
meta-refresh** redirects (link shorteners, the old getnews stubs) are
also followed — the target is SSRF-re-guarded and fetched, so the
reader returns the real article, not the "Redirecting…" stub.
### URL-05 — Fetched text is bounded and sanitized (coverage: test)