Update:Support for ENV variables to disable SSRF request filter (DISABLE_SSRF_REQUEST_FILTER=1) #2549

server/Server.js

@@ -51,6 +51,7 @@ class Server {
     global.RouterBasePath = ROUTER_BASE_PATH
     global.XAccel = process.env.USE_X_ACCEL
     global.AllowCors = process.env.ALLOW_CORS === '1'
+    global.DisableSsrfRequestFilter = process.env.DISABLE_SSRF_REQUEST_FILTER === '1'
 
     if (!fs.pathExistsSync(global.ConfigPath)) {
       fs.mkdirSync(global.ConfigPath)

server/utils/fileUtils.js

@@ -7,13 +7,12 @@ const rra = require('../libs/recursiveReaddirAsync')
 const Logger = require('../Logger')
 const { AudioMimeType } = require('./constants')
 
-
 /**
-* Make sure folder separator is POSIX for Windows file paths. e.g. "C:\Users\Abs" becomes "C:/Users/Abs"
+ * Make sure folder separator is POSIX for Windows file paths. e.g. "C:\Users\Abs" becomes "C:/Users/Abs"
-*
+ *
-* @param {String} path - Ugly file path
+ * @param {String} path - Ugly file path
-* @return {String} Pretty posix file path
+ * @return {String} Pretty posix file path
-*/
+ */
 const filePathToPOSIX = (path) => {
   if (!global.isWin || !path) return path
   return path.replace(/\\/g, '/')
@@ -33,8 +32,8 @@ function isSameOrSubPath(parentPath, childPath) {
   if (parentPath === childPath) return true
   const relativePath = Path.relative(parentPath, childPath)
   return (
-    relativePath === '' // Same path (e.g. parentPath = '/a/b/', childPath = '/a/b')
+    relativePath === '' || // Same path (e.g. parentPath = '/a/b/', childPath = '/a/b')
-    || !relativePath.startsWith('..') && !Path.isAbsolute(relativePath) // Sub path
+    (!relativePath.startsWith('..') && !Path.isAbsolute(relativePath)) // Sub path
   )
 }
 module.exports.isSameOrSubPath = isSameOrSubPath
@@ -106,10 +105,13 @@ async function checkPathIsFile(filepath) {
 module.exports.checkPathIsFile = checkPathIsFile
 
 function getIno(path) {
-  return fs.stat(path, { bigint: true }).then((data => String(data.ino))).catch((err) => {
+  return fs
-    Logger.error('[Utils] Failed to get ino for path', path, err)
+    .stat(path, { bigint: true })
-    return null
+    .then((data) => String(data.ino))
-  })
+    .catch((err) => {
+      Logger.error('[Utils] Failed to get ino for path', path, err)
+      return null
+    })
 }
 module.exports.getIno = getIno
 
@@ -177,55 +179,58 @@ async function recurseFiles(path, relPathToReplace = null) {
 
   const directoriesToIgnore = []
 
-  list = list.filter((item) => {
+  list = list
-    if (item.error) {
+    .filter((item) => {
-      Logger.error(`[fileUtils] Recurse files file "${item.fullname}" has error`, item.error)
+      if (item.error) {
-      return false
+        Logger.error(`[fileUtils] Recurse files file "${item.fullname}" has error`, item.error)
-    }
+        return false
+      }
 
-    const relpath = item.fullname.replace(relPathToReplace, '')
+      const relpath = item.fullname.replace(relPathToReplace, '')
-    let reldirname = Path.dirname(relpath)
+      let reldirname = Path.dirname(relpath)
-    if (reldirname === '.') reldirname = ''
+      if (reldirname === '.') reldirname = ''
-    const dirname = Path.dirname(item.fullname)
+      const dirname = Path.dirname(item.fullname)
 
-    // Directory has a file named ".ignore" flag directory and ignore
+      // Directory has a file named ".ignore" flag directory and ignore
-    if (item.name === '.ignore' && reldirname && reldirname !== '.' && !directoriesToIgnore.includes(dirname)) {
+      if (item.name === '.ignore' && reldirname && reldirname !== '.' && !directoriesToIgnore.includes(dirname)) {
-      Logger.debug(`[fileUtils] .ignore found - ignoring directory "${reldirname}"`)
+        Logger.debug(`[fileUtils] .ignore found - ignoring directory "${reldirname}"`)
-      directoriesToIgnore.push(dirname)
+        directoriesToIgnore.push(dirname)
-      return false
+        return false
-    }
+      }
 
-    if (item.extension === '.part') {
+      if (item.extension === '.part') {
-      Logger.debug(`[fileUtils] Ignoring .part file "${relpath}"`)
+        Logger.debug(`[fileUtils] Ignoring .part file "${relpath}"`)
-      return false
+        return false
-    }
+      }
 
-    // Ignore any file if a directory or the filename starts with "."
+      // Ignore any file if a directory or the filename starts with "."
-    if (relpath.split('/').find(p => p.startsWith('.'))) {
+      if (relpath.split('/').find((p) => p.startsWith('.'))) {
-      Logger.debug(`[fileUtils] Ignoring path has . "${relpath}"`)
+        Logger.debug(`[fileUtils] Ignoring path has . "${relpath}"`)
-      return false
+        return false
-    }
+      }
 
-    return true
+      return true
-  }).filter(item => {
+    })
-    // Filter out items in ignore directories
+    .filter((item) => {
-    if (directoriesToIgnore.some(dir => item.fullname.startsWith(dir))) {
+      // Filter out items in ignore directories
-      Logger.debug(`[fileUtils] Ignoring path in dir with .ignore "${item.fullname}"`)
+      if (directoriesToIgnore.some((dir) => item.fullname.startsWith(dir))) {
-      return false
+        Logger.debug(`[fileUtils] Ignoring path in dir with .ignore "${item.fullname}"`)
-    }
+        return false
-    return true
+      }
-  }).map((item) => {
+      return true
-    var isInRoot = (item.path + '/' === relPathToReplace)
+    })
-    return {
+    .map((item) => {
-      name: item.name,
+      var isInRoot = item.path + '/' === relPathToReplace
-      path: item.fullname.replace(relPathToReplace, ''),
+      return {
-      dirpath: item.path,
+        name: item.name,
-      reldirpath: isInRoot ? '' : item.path.replace(relPathToReplace, ''),
+        path: item.fullname.replace(relPathToReplace, ''),
-      fullpath: item.fullname,
+        dirpath: item.path,
-      extension: item.extension,
+        reldirpath: isInRoot ? '' : item.path.replace(relPathToReplace, ''),
-      deep: item.deep
+        fullpath: item.fullname,
-    }
+        extension: item.extension,
-  })
+        deep: item.deep
+      }
+    })
 
   // Sort from least deep to most
   list.sort((a, b) => a.deep - b.deep)
@@ -251,24 +256,26 @@ module.exports.downloadFile = (url, filepath, contentTypeFilter = null) => {
       method: 'GET',
       responseType: 'stream',
       timeout: 30000,
-      httpAgent: ssrfFilter(url),
+      httpAgent: global.DisableSsrfRequestFilter ? null : ssrfFilter(feedUrl),
-      httpsAgent: ssrfFilter(url)
+      httpsAgent: global.DisableSsrfRequestFilter ? null : ssrfFilter(feedUrl)
-    }).then((response) => {
-      // Validate content type
-      if (contentTypeFilter && !contentTypeFilter?.(response.headers?.['content-type'])) {
-        return reject(new Error(`Invalid content type "${response.headers?.['content-type'] || ''}"`))
-      }
-
-      // Write to filepath
-      const writer = fs.createWriteStream(filepath)
-      response.data.pipe(writer)
-
-      writer.on('finish', resolve)
-      writer.on('error', reject)
-    }).catch((err) => {
-      Logger.error(`[fileUtils] Failed to download file "${filepath}"`, err)
-      reject(err)
     })
+      .then((response) => {
+        // Validate content type
+        if (contentTypeFilter && !contentTypeFilter?.(response.headers?.['content-type'])) {
+          return reject(new Error(`Invalid content type "${response.headers?.['content-type'] || ''}"`))
+        }
+
+        // Write to filepath
+        const writer = fs.createWriteStream(filepath)
+        response.data.pipe(writer)
+
+        writer.on('finish', resolve)
+        writer.on('error', reject)
+      })
+      .catch((err) => {
+        Logger.error(`[fileUtils] Failed to download file "${filepath}"`, err)
+        reject(err)
+      })
   })
 }
 
@@ -350,14 +357,17 @@ module.exports.getAudioMimeTypeFromExtname = (extname) => {
 
 module.exports.removeFile = (path) => {
   if (!path) return false
-  return fs.remove(path).then(() => true).catch((error) => {
+  return fs
-    Logger.error(`[fileUtils] Failed remove file "${path}"`, error)
+    .remove(path)
-    return false
+    .then(() => true)
-  })
+    .catch((error) => {
+      Logger.error(`[fileUtils] Failed remove file "${path}"`, error)
+      return false
+    })
 }
 
 module.exports.encodeUriPath = (path) => {
-  const uri = new URL('/', "file://")
+  const uri = new URL('/', 'file://')
   // we assign the path here to assure that URL control characters like # are
   // actually interpreted as part of the URL path
   uri.pathname = path
@@ -398,7 +408,11 @@ module.exports.getWindowsDrives = async () => {
         reject(error)
         return
       }
-      let drives = stdout?.split(/\r?\n/).map(line => line.trim()).filter(line => line).slice(1)
+      let drives = stdout
+        ?.split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line)
+        .slice(1)
       const validDrives = []
       for (const drive of drives) {
         let drivepath = drive + '/'
@@ -423,22 +437,24 @@ module.exports.getWindowsDrives = async () => {
 module.exports.getDirectoriesInPath = async (dirPath, level) => {
   try {
     const paths = await fs.readdir(dirPath)
-    let dirs = await Promise.all(paths.map(async dirname => {
+    let dirs = await Promise.all(
-      const fullPath = Path.join(dirPath, dirname)
+      paths.map(async (dirname) => {
+        const fullPath = Path.join(dirPath, dirname)
 
-      const lstat = await fs.lstat(fullPath).catch((error) => {
+        const lstat = await fs.lstat(fullPath).catch((error) => {
-        Logger.debug(`Failed to lstat "${fullPath}"`, error)
+          Logger.debug(`Failed to lstat "${fullPath}"`, error)
-        return null
+          return null
+        })
+        if (!lstat?.isDirectory()) return null
+
+        return {
+          path: this.filePathToPOSIX(fullPath),
+          dirname,
+          level
+        }
       })
-      if (!lstat?.isDirectory()) return null
+    )
-
+    dirs = dirs.filter((d) => d)
-      return {
-        path: this.filePathToPOSIX(fullPath),
-        dirname,
-        level
-      }
-    }))
-    dirs = dirs.filter(d => d)
     return dirs
   } catch (error) {
     Logger.error('Failed to readdir', dirPath, error)

server/utils/podcastUtils.js

@@ -234,37 +234,38 @@ module.exports.getPodcastFeed = (feedUrl, excludeEpisodeMetadata = false) => {
     timeout: 12000,
     responseType: 'arraybuffer',
     headers: { Accept: 'application/rss+xml, application/xhtml+xml, application/xml, */*;q=0.8' },
-    httpAgent: ssrfFilter(feedUrl),
+    httpAgent: global.DisableSsrfRequestFilter ? null : ssrfFilter(feedUrl),
-    httpsAgent: ssrfFilter(feedUrl)
+    httpsAgent: global.DisableSsrfRequestFilter ? null : ssrfFilter(feedUrl)
-  }).then(async (data) => {
-
-    // Adding support for ios-8859-1 encoded RSS feeds.
-    //  See: https://github.com/advplyr/audiobookshelf/issues/1489
-    const contentType = data.headers?.['content-type'] || '' // e.g. text/xml; charset=iso-8859-1
-    if (contentType.toLowerCase().includes('iso-8859-1')) {
-      data.data = data.data.toString('latin1')
-    } else {
-      data.data = data.data.toString()
-    }
-
-    if (!data?.data) {
-      Logger.error(`[podcastUtils] getPodcastFeed: Invalid podcast feed request response (${feedUrl})`)
-      return null
-    }
-    Logger.debug(`[podcastUtils] getPodcastFeed for "${feedUrl}" success - parsing xml`)
-    const payload = await this.parsePodcastRssFeedXml(data.data, excludeEpisodeMetadata)
-    if (!payload) {
-      return null
-    }
-
-    // RSS feed may be a private RSS feed
-    payload.podcast.metadata.feedUrl = feedUrl
-
-    return payload.podcast
-  }).catch((error) => {
-    Logger.error('[podcastUtils] getPodcastFeed Error', error)
-    return null
   })
+    .then(async (data) => {
+      // Adding support for ios-8859-1 encoded RSS feeds.
+      //  See: https://github.com/advplyr/audiobookshelf/issues/1489
+      const contentType = data.headers?.['content-type'] || '' // e.g. text/xml; charset=iso-8859-1
+      if (contentType.toLowerCase().includes('iso-8859-1')) {
+        data.data = data.data.toString('latin1')
+      } else {
+        data.data = data.data.toString()
+      }
+
+      if (!data?.data) {
+        Logger.error(`[podcastUtils] getPodcastFeed: Invalid podcast feed request response (${feedUrl})`)
+        return null
+      }
+      Logger.debug(`[podcastUtils] getPodcastFeed for "${feedUrl}" success - parsing xml`)
+      const payload = await this.parsePodcastRssFeedXml(data.data, excludeEpisodeMetadata)
+      if (!payload) {
+        return null
+      }
+
+      // RSS feed may be a private RSS feed
+      payload.podcast.metadata.feedUrl = feedUrl
+
+      return payload.podcast
+    })
+    .catch((error) => {
+      Logger.error('[podcastUtils] getPodcastFeed Error', error)
+      return null
+    })
 }
 
 // Return array of episodes ordered by closest match (Levenshtein distance of 6 or less)
@@ -283,7 +284,7 @@ module.exports.findMatchingEpisodesInFeed = (feed, searchTitle) => {
   }
 
   const matches = []
-  feed.episodes.forEach(ep => {
+  feed.episodes.forEach((ep) => {
     if (!ep.title) return
 
     const epTitle = ep.title.toLowerCase().trim()