Repository navigation
Expand file tree
/
Copy pathnews.js
More file actions
160 lines (153 loc) · 4.17 KB
/
Copy pathnews.js
File metadata and controls
160 lines (153 loc) · 4.17 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
import {
createTimeout,
jsonResponse,
readLimitedBytes,
} from "./http.js";
import { BUILT_IN_RSS_FEEDS } from "./news-feeds.js";
const FEEDS = new Map(
BUILT_IN_RSS_FEEDS.map(({ id, url }) => [id, url]),
);
const MAX_BYTES = 1_000_000;
const TIMEOUT_MS = 8_000;
const XML_CONTENT_TYPE = /^(?:application\/(?:atom\+xml|rss\+xml|xml)|text\/xml)(?:;|$)/i;
const PRIVATE_SUFFIXES = [
".internal",
".local",
".localhost",
".home",
".lan",
];
function newsError(code, message, status) {
return jsonResponse({ error: { code, message } }, { status });
}
function customFeedUrl(value) {
if (!value) return undefined;
try {
const url = new URL(value);
const hostname = url.hostname.toLowerCase();
const isIpLiteral = hostname.includes(":")
|| /^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname);
if (
url.protocol !== "https:"
|| url.username
|| url.password
|| url.hash
|| (url.port && url.port !== "443")
|| !hostname
|| hostname === "localhost"
|| isIpLiteral
|| PRIVATE_SUFFIXES.some((suffix) => hostname.endsWith(suffix))
) {
return null;
}
return url.toString();
} catch {
return null;
}
}
function looksLikeFeed(bytes) {
const text = new TextDecoder().decode(bytes).replace(/^\uFEFF/, "");
const withoutPreamble = text
.replace(/^\s*<\?xml[\s\S]*?\?>/i, "")
.replace(/^\s*<!--[\s\S]*?-->/, "")
.trimStart();
return /^<(?:rss|feed|(?:[A-Za-z_][\w.-]*:)?RDF)(?:\s|>)/i
.test(withoutPreamble);
}
export async function handleNewsRequest(
request,
_env,
{
fetchImpl = fetch,
setTimeoutImpl = setTimeout,
clearTimeoutImpl = clearTimeout,
} = {},
) {
const requestUrl = new URL(request.url);
const fixedFeed = FEEDS.get(requestUrl.searchParams.get("feed"));
const customParameter = requestUrl.searchParams.get("url");
const customFeed = customFeedUrl(customParameter);
if (customParameter && customFeed === null) {
return newsError("UNSAFE_FEED_URL", "Unsafe news feed URL", 400);
}
const feed = fixedFeed ?? customFeed;
if (!feed) {
return newsError(
"UNSUPPORTED_FEED",
"Unsupported news feed",
400,
);
}
const timeout = createTimeout(
TIMEOUT_MS,
setTimeoutImpl,
clearTimeoutImpl,
);
try {
const upstream = await fetchImpl(feed, {
redirect: "manual",
headers: {
accept: "application/rss+xml, application/xml, text/xml",
},
signal: timeout.signal,
});
if (upstream.status >= 300 && upstream.status < 400) {
return newsError(
"NEWS_REDIRECT",
"News upstream redirects are not allowed",
502,
);
}
if (!upstream.ok) {
return newsError(
"NEWS_UPSTREAM_ERROR",
"News upstream request failed",
502,
);
}
const contentType = upstream.headers.get("content-type") ?? "";
if (!XML_CONTENT_TYPE.test(contentType)) {
await upstream.body?.cancel();
return newsError(
"NEWS_CONTENT_TYPE",
"News upstream did not return XML",
502,
);
}
const bytes = await readLimitedBytes(upstream, MAX_BYTES);
if (!looksLikeFeed(bytes)) {
return newsError(
"NEWS_INVALID_FEED",
"News upstream did not return an RSS or Atom feed",
502,
);
}
const custom = customFeed !== undefined;
return new Response(bytes, {
status: 200,
headers: {
"content-type": custom
? "application/xml; charset=utf-8"
: "application/rss+xml; charset=utf-8",
"cache-control": custom
? "no-store"
: "public, max-age=300, s-maxage=300, stale-while-revalidate=600",
"x-content-type-options": "nosniff",
},
});
} catch (error) {
if (timeout.signal.aborted || error?.name === "AbortError") {
return newsError("NEWS_TIMEOUT", "News request timed out", 504);
}
if (error instanceof Error && error.message === "RESPONSE_TOO_LARGE") {
return newsError("NEWS_TOO_LARGE", "News response is too large", 502);
}
return newsError(
"NEWS_UPSTREAM_ERROR",
"News upstream request failed",
502,
);
} finally {
timeout.dispose();
}
}