src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: check plugin http.post url against origin and add regression tests

Browse Source
This commit is contained in:
Niklas Voss
2026-04-01 11:26:12 +02:00
committed by Linus Rath
parent 2734fa08b7
commit 52326326e2
2 changed files with 50 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/plugin-api.ts
+7 -3
View File
@@ -647,8 +647,12 @@ export function createPluginAPI(plugin: InstalledPlugin): PluginAPI {
http: {
post: async (path: string, body: Record<string, unknown>) => {
requirePermission(plugin, 'http:post');
if (typeof path !== 'string' || !path.startsWith('/')) {
throw new Error('path must be an absolute path starting with /');
if (typeof path !== 'string' || !path.startsWith('/api/')) {
throw new Error('path must start with /api/');
}
const url = new URL(path, globalThis.location.origin);
if (url.origin !== globalThis.location.origin) {
throw new Error('path must resolve to the same origin');
}
const { client } = useAuthStore.getState();
const headers: Record<string, string> = { 'Content-Type': 'application/json' };
@@ -656,7 +660,7 @@ export function createPluginAPI(plugin: InstalledPlugin): PluginAPI {
headers['Authorization'] = client.getAuthHeader();
headers['X-JMAP-Username'] = client.getUsername();
}
const res = await fetch(path, {
const res = await fetch(url.pathname + url.search, {
method: 'POST',
headers,
body: JSON.stringify(body),