4 ms·

Thanks for sharing the code mate. May i also suggest adding a token/password if you want to reduce attack surface. Also from a quick glance, this looks like it

by ebfe1 5y ago

Thanks for sharing the code mate. May i also suggest adding a token/password if you want to reduce attack surface. Also from a quick glance, this looks like it is vulnerable to ssrf style attack. This type of service is often vulnerable to it given the nature of it is fetching url on user's behalf. I would suggest either isolate it, have a whitelist of domains that you trust or having iptables to deny internal access. Nice work regardless!

jimmies 5y ago
Thanks for the suggestions. I know this implementation has more holes than a swiss cheese, but I will try to plug them as I figure out how to deal with js callbacks :)
- andrewstuart2 5y ago
  And you may very well know this, but keep in mind that if this is on a LAN only and not port forwarded in from the internet, that substantially reduces your exposure; to exploit anything on your server code they'd need to be running behind your firewall. And there are probably juicier targets at that point.
  - ebfe1 5y ago
    Ohh I am 100% agree with this! sorry if I missed the LAN part in the original post. :Facepalm: