server/middlewares/validators/oembed.ts

   1 import * as express from 'express'
   2 import { query } from 'express-validator'
   3 import { join } from 'path'
   4 import { isTestInstance } from '../../helpers/core-utils'
   5 import { isIdOrUUIDValid } from '../../helpers/custom-validators/misc'
   6 import { logger } from '../../helpers/logger'
   7 import { areValidationErrors } from './utils'
   8 import { WEBSERVER } from '../../initializers/constants'
   9 import { doesVideoExist } from '../../helpers/middlewares'
  10
  11 const urlShouldStartWith = WEBSERVER.SCHEME + '://' + join(WEBSERVER.HOST, 'videos', 'watch') + '/'
  12 const videoWatchRegex = new RegExp('([^/]+)$')
  13 const isURLOptions = {
  14   require_host: true,
  15   require_tld: true
  16 }
  17
  18 // We validate 'localhost', so we don't have the top level domain
  19 if (isTestInstance()) {
  20   isURLOptions.require_tld = false
  21 }
  22
  23 const oembedValidator = [
  24   query('url').isURL(isURLOptions).withMessage('Should have a valid url'),
  25   query('maxwidth').optional().isInt().withMessage('Should have a valid max width'),
  26   query('maxheight').optional().isInt().withMessage('Should have a valid max height'),
  27   query('format').optional().isIn([ 'xml', 'json' ]).withMessage('Should have a valid format'),
  28
  29   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  30     logger.debug('Checking oembed parameters', { parameters: req.query })
  31
  32     if (areValidationErrors(req, res)) return
  33
  34     if (req.query.format !== undefined && req.query.format !== 'json') {
  35       return res.status(501)
  36                 .json({ error: 'Requested format is not implemented on server.' })
  37                 .end()
  38     }
  39
  40     const startIsOk = req.query.url.startsWith(urlShouldStartWith)
  41     const matches = videoWatchRegex.exec(req.query.url)
  42     if (startIsOk === false || matches === null) {
  43       return res.status(400)
  44                 .json({ error: 'Invalid url.' })
  45                 .end()
  46     }
  47
  48     const videoId = matches[1]
  49     if (isIdOrUUIDValid(videoId) === false) {
  50       return res.status(400)
  51                 .json({ error: 'Invalid video id.' })
  52                 .end()
  53     }
  54
  55     if (!await doesVideoExist(videoId, res)) return
  56
  57     return next()
  58   }
  59 ]
  60
  61 // ---------------------------------------------------------------------------
  62
  63 export {
  64   oembedValidator
  65 }