diff options
| author | Adam Soltys <[email protected]> | 2026-06-15 23:35:50 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-06-15 23:35:50 -0700 |
| commit | 497277ef7b48c86aa2f44b613e0a35a0c3b0c238 (patch) | |
| tree | 5a05d5f2f1bc739d9bd76f96b5eaeb94f09224fa /scripts | |
| parent | 35df18174ab61c6d4a72bf8f1157584adb14bc4f (diff) | |
| download | coinos-server-497277ef7b48c86aa2f44b613e0a35a0c3b0c238.tar.gz coinos-server-497277ef7b48c86aa2f44b613e0a35a0c3b0c238.zip | |
lnurl: SSRF-guard user-supplied URL fetches + validate zap events
The /lnurl/proxy, /decode and /encode handlers fetched an arbitrary
user-supplied URL via got() and returned the body — an unauthenticated
SSRF reaching internal services. Route those fetches through a new
safeGot() that rejects hosts resolving to loopback/private/link-local/
CGNAT/metadata ranges, re-validates on each redirect hop, restricts the
scheme to http(s), and caps timeout + response size. Also validate the
NIP-57 zap request (kind 9734 + signature) before storing it, instead of
trusting the client-supplied event.
These endpoints can't be removed — they back lightning-address/LNURL
parsing and resolution in the wallet UI.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions