From d8d1ced0cb47fbf192444b94ac564e6be8bdbe43 Mon Sep 17 00:00:00 2001 From: Ardis Lu Date: Wed, 20 Jul 2022 19:49:37 -0700 Subject: [PATCH] Block API calls to non-Google domains --- functions/api.js | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/functions/api.js b/functions/api.js index 8e3bd37..ed462eb 100644 --- a/functions/api.js +++ b/functions/api.js @@ -2,10 +2,16 @@ import { getGoogleAuthToken } from './auth.js'; export async function onRequestGet({ request, env }) { const url = new URL(request.url); - const queryString = decodeURIComponent(url.search.substring(1)); + const queryUrl = new URL(decodeURIComponent(url.search.substring(1))); + + // To prevent service account token from leaking to non-Google domains + if (!(queryUrl.hostname === 'sheets.googleapis.com' || queryUrl.hostname === 'docs.googleapis.com')) { + return new Response('Invalid query URL. Query URL hostname must be "sheets.googleapis.com" or "docs.googleapis.com".', { status: 400 }); + } + const token = await getGoogleAuthToken(env.EMAIL, env.PRIVATE_KEY, env.SCOPES); - const response = await fetch(queryString, { + const response = await fetch(queryUrl, { cf: { cacheEverything: true, cacheTtl: 86400 -- 2.47.3