From 76b0da1983271bcc75050d5611cdbeafaa124d5b Mon Sep 17 00:00:00 2001 From: Harsh Shandilya Date: Wed, 16 Nov 2022 14:27:40 +0530 Subject: [PATCH] fix(webfinger): restrict valid identities --- netlify/edge-functions/webfinger/webfinger.ts | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/netlify/edge-functions/webfinger/webfinger.ts b/netlify/edge-functions/webfinger/webfinger.ts index 1c15976..193e946 100755 --- a/netlify/edge-functions/webfinger/webfinger.ts +++ b/netlify/edge-functions/webfinger/webfinger.ts @@ -2,7 +2,6 @@ import { Status } from "https://deno.land/std@0.136.0/http/http_status.ts"; import type { Context } from "https://edge.netlify.com"; export default async (request: Request, context: Context) => { - const re = /acct:(.*)@msfjarvis.dev/; const url = new URL(request.url); const resourceParam = url.searchParams.get("resource"); if (resourceParam === null) { @@ -14,10 +13,10 @@ export default async (request: Request, context: Context) => { status: Status.BadRequest, } ); - } else if (resourceParam.match(re) === null) { + } else if (resourceParam !== "acct:harsh@msfjarvis.dev") { return context.json( { - error: "This domain only works for @msfjarvis.dev requests", + error: "An invalid identity was requested", }, { status: Status.BadRequest,