From 2a4c432f41580cf2afa97bfd1a35153883b318db Mon Sep 17 00:00:00 2001
From: Hazelnoot <acomputerdog@gmail.com>
Date: Mon, 18 Nov 2024 10:41:31 -0500
Subject: [PATCH] don't generate URL previews for blocked domains

---
 .../backend/src/server/web/UrlPreviewService.ts    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/packages/backend/src/server/web/UrlPreviewService.ts b/packages/backend/src/server/web/UrlPreviewService.ts
index 26ea185586..19dac1dfb8 100644
--- a/packages/backend/src/server/web/UrlPreviewService.ts
+++ b/packages/backend/src/server/web/UrlPreviewService.ts
@@ -17,6 +17,7 @@ import { bindThis } from '@/decorators.js';
 import { ApiError } from '@/server/api/error.js';
 import { MiMeta } from '@/models/Meta.js';
 import { RedisKVCache } from '@/misc/cache.js';
+import { UtilityService } from '@/core/UtilityService.js';
 import type { FastifyRequest, FastifyReply } from 'fastify';
 
 @Injectable()
@@ -36,6 +37,7 @@ export class UrlPreviewService {
 
 		private httpRequestService: HttpRequestService,
 		private loggerService: LoggerService,
+		private utilityService: UtilityService,
 	) {
 		this.logger = this.loggerService.getLogger('url-preview');
 		this.previewCache = new RedisKVCache<SummalyResult>(this.redisClient, 'summaly', {
@@ -87,6 +89,18 @@ export class UrlPreviewService {
 			};
 		}
 
+		const host = new URL(url).host;
+		if (this.utilityService.isBlockedHost(this.meta.blockedHosts, host)) {
+			reply.code(403);
+			return {
+				error: new ApiError({
+					message: 'URL is blocked',
+					code: 'URL_PREVIEW_BLOCKED',
+					id: '50294652-857b-4b13-9700-8e5c7a8deae8',
+				}),
+			};
+		}
+
 		const key = `${url}@${lang}`;
 		const cached = await this.previewCache.get(key);
 		if (cached !== undefined) {