Block API calls to non-Google domains

diff --git a/functions/api.js b/functions/api.js
index 8e3bd376ea77421fe0bfb8ae7a7dae4c653e7b73..ed462eb6adacc2b29b8f057db18f4f45191a134f 100644 (file)
--- a/functions/api.js
+++ b/functions/api.js
@@ -2,10 +2,16 @@ import { getGoogleAuthToken } from './auth.js';
 
 export async function onRequestGet({ request, env }) {
   const url = new URL(request.url);
-  const queryString = decodeURIComponent(url.search.substring(1));
+  const queryUrl = new URL(decodeURIComponent(url.search.substring(1)));
+
+  // To prevent service account token from leaking to non-Google domains
+  if (!(queryUrl.hostname === 'sheets.googleapis.com' || queryUrl.hostname === 'docs.googleapis.com')) {
+    return new Response('Invalid query URL. Query URL hostname must be "sheets.googleapis.com" or "docs.googleapis.com".', { status: 400 });
+  }
+
   const token = await getGoogleAuthToken(env.EMAIL, env.PRIVATE_KEY, env.SCOPES);
 
-  const response = await fetch(queryString, {
+  const response = await fetch(queryUrl, {
     cf: {
       cacheEverything: true,
       cacheTtl: 86400