url blacklist

mediaapi/routing/url_preview.go

@@ -12,6 +12,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"sync"
@@ -37,6 +38,7 @@ var (
 	ErrorFileTooLarge              = errors.New("file too large")
 	ErrorTimeoutThumbnailGenerator = errors.New("timeout waiting for thumbnail generator")
 	ErrNoMetadataFound             = errors.New("no metadata found")
+	ErrorBlackListed               = errors.New("url is blacklisted")
 )
 
 func makeUrlPreviewHandler(
@@ -48,6 +50,7 @@ func makeUrlPreviewHandler(
 
 	activeUrlPreviewRequests := &types.ActiveUrlPreviewRequests{Url: map[string]*types.UrlPreviewResult{}}
 	urlPreviewCache := &types.UrlPreviewCache{Records: map[string]*types.UrlPreviewCacheRecord{}}
+	urlBlackList := createUrlBlackList(cfg)
 
 	go func() {
 		for {
@@ -83,6 +86,14 @@ func makeUrlPreviewHandler(
 			return *r
 		}
 
+		// Check if the url is in the blacklist
+		for _, pattern := range urlBlackList {
+			if pattern.MatchString(pUrl) {
+				logger.WithField("pattern", pattern.String()).Warn("the url is blacklisted")
+				return util.ErrorResponse(ErrorBlackListed)
+			}
+		}
+
 		// Get url preview from cache
 		if cacheRecord, ok := urlPreviewCache.Records[pUrl]; ok {
 			if cacheRecord.Error != nil {
@@ -625,3 +636,12 @@ func getMetaFieldsFromHTML(resp *http.Response) map[string]string {
 	}
 	return ogValues
 }
+
+func createUrlBlackList(cfg *config.MediaAPI) []*regexp.Regexp {
+	blackList := make([]*regexp.Regexp, len(cfg.UrlPreviewBlacklist))
+	for i, pattern := range cfg.UrlPreviewBlacklist {
+		blackList[i] = regexp.MustCompile(pattern)
+	}
+	return blackList
+
+}

setup/config/config_mediaapi.go

@@ -31,6 +31,9 @@ type MediaAPI struct {
 	// A list of thumbnail sizes to be pre-generated for downloaded remote / uploaded content
 	ThumbnailSizes []ThumbnailSize `yaml:"thumbnail_sizes"`
 
+	// Black list of urls
+	UrlPreviewBlacklist []string `yaml:"url_preview_blacklist"`
+
 	// The time in seconds to cache URL previews for
 	UrlPreviewCacheTime int `yaml:"url_preview_cache_time"`