mirrors/nitter
Watch
1
0
Fork
You've already forked nitter
 0
mirror of https://github.com/zedeus/nitter synced 2026-09-05 14:49:32 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix SSRF in /video proxy and API JSON injection

Browse source 
Validate the target host on the /video media route with
isTwitterUrl() (mirroring /pic) and reject non-http(s) schemes,
and stop the media proxy following redirects off the validated
host. JSON-escape user-controlled GraphQL cursors and build id
variables with packedjson so untrusted input can't break out of
the query. Warn on startup when the insecure default hmacKey is
in use.

Fixes #1411
This commit is contained in:
Zed 2026-06-18 15:01:48 +02:00
commit 44b2f096f6
7 changed files with 69 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nitter.example.conf
View file

@ -20,7 +20,7 @@ redisMaxConnections = 30
# you receive tons of requests per second
[Config]
hmacKey = "secretkey" # random key for cryptographic signing of video urls
hmacKey = "secretkey" # CHANGE THIS to a unique random value (e.g. `openssl rand -hex 32`); signs media urls
base64Media = false # use base64 encoding for proxied media urls
enableRSS = true # master switch, set to false to disable all RSS feeds
enableRSSUserTweets = true # /@user/rss