adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-15 20:02:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(outboundURLs): better detaults

Browse Source
This commit is contained in:
Julien Neuhart
2026-04-11 13:05:05 +02:00
parent 405d8d1c2b
commit 924576d3d4
8 changed files with 703 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/modules/chromium/browser.go
View File

@@ -336,8 +336,9 @@ func (b *chromiumBrowser) do(ctx context.Context, logger *slog.Logger, url strin
return errors.New("context has no deadline")
}
// We validate the "main" URL against our allowed / deny lists.
err := gotenberg.FilterDeadline(b.arguments.allowList, b.arguments.denyList, url, deadline)
// We validate the "main" URL against our allowed / deny lists, and
// against the IP-based outbound URL guard. See [gotenberg.FilterOutboundURL].
err := gotenberg.FilterOutboundURL(ctx, url, b.arguments.allowList, b.arguments.denyList, deadline)
if err != nil {
return fmt.Errorf("filter URL: %w", err)
}

11
pkg/modules/chromium/events.go
View File

@@ -52,7 +52,7 @@ func listenForEventRequestPaused(ctx context.Context, logger *slog.Logger, optio
return
}
err := gotenberg.FilterDeadline(options.allowList, options.denyList, e.Request.URL, deadline)
err := gotenberg.FilterOutboundURL(ctx, e.Request.URL, options.allowList, options.denyList, deadline)
if err != nil {
logger.WarnContext(ctx, err.Error())
allow = false
@@ -81,6 +81,15 @@ func listenForEventRequestPaused(ctx context.Context, logger *slog.Logger, optio
executorCtx := cdp.WithExecutor(ctx, cctx.Target)
if !allow {
// Use AccessDenied so Chromium emits net::ERR_ACCESS_DENIED,
// which is intentionally absent from the EventLoadingFailed
// known-errors list. Routing through BlockedByClient would
// surface the failure, but the Document-type dispatcher in
// listenForEventLoadingFailed cannot distinguish a blocked
// iframe (sub-frame Document) from a main-page Document, and
// would attribute the iframe failure to the main page.
// Filter-block observability is provided by the warn log
// above instead.
req := fetch.FailRequest(e.RequestID, network.ErrorReasonAccessDenied)
err = req.Do(executorCtx)
if err != nil {