Fix security vulnerabilities

2026-10-13 15:52:34 +01:00
parent 74103a19c9
commit eefb2ea5d2
46 changed files with 375 additions and 403 deletions
@@ -7,6 +7,19 @@ export default async function generateWebPageGetCachePage({ module, routeParams,
    const expiry_seconds = config?.cacheExpiry || serverRes?.cache_expiry;
    if (cache_page && routeParams?.url) {
        try {
+            const status = serverRes?.response_options?.status;
+            if (status && (status < 200 || status >= 300)) {
+                return false;
+            }
+            const res_headers = new Headers(serverRes?.response_options?.headers);
+            if (res_headers.has("set-cookie")) {
+                return false;
+            }
+            const req_headers = routeParams.req.headers;
+            if (!global.BUNEXT_CONFIG?.cache_credentialed_requests &&
+                (req_headers.has("cookie") || req_headers.has("authorization"))) {
+                return false;
+            }
            const is_cache = typeof cache_page == "boolean"
                ? cache_page
                : await cache_page({ ctx: routeParams, serverRes });