/
githubmirror
/
photoprism
Обзор
Документация
Войти
/
githubmirror
/
photoprism
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
develop
internal/service/request.go
61 строка
1 KB
Michael Mayer
Security: Add gosec fixes with shared URL and fs validation helpers
03 мар 2026, 18:38
03 мар 2026, 18:38
f2aabb9
Код
Авторство
О чём код?
package service import ( "net" "net/http" "time" "github.com/photoprism/photoprism/pkg/http/safe" ) // TestRequest makes a test request to the given URL and returns true if successful. func (h Heuristic) TestRequest(method, rawUrl string, allowedCIDRs []*net.IPNet) bool { u, err := safe.URL(rawUrl) if err != nil { return false } if validateErr := ValidateURLHost(u, allowedCIDRs, 5*time.Second); validateErr != nil { return false } req, err := http.NewRequest(method, rawUrl, nil) if err != nil { return false } // Add custom request headers: // https://github.com/photoprism/photoprism/pull/4608 if len(h.Headers) > 0 { for key, val := range h.Headers { req.Header.Add(key, val) } } // Create new http.Client instance. // // NOTE: Timeout specifies a time limit for requests made by // this Client. The timeout includes connection time, any // redirects, and reading the response body. The timer remains // running after Get, Head, Post, or Do return and will // interrupt reading of the Response.Body. client := NewHTTPClient(30*time.Second, allowedCIDRs) // Send request to see if it fails. // // #nosec G704 Request URL was validated via ValidateURLHost and client // transport enforces CIDR restrictions for direct/redirected connections. if resp, reqErr := client.Do(req); reqErr != nil { return false } else { _ = resp.Body.Close() if resp.StatusCode < 400 { return true } } return false }