misskey-dev / media-proxy Goto Github PK
View Code? Open in Web Editor NEWMedia Proxy for Misskey
License: GNU Affero General Public License v3.0
Media Proxy for Misskey
License: GNU Affero General Public License v3.0
1.NODE_ENV=production pnpm install
2.Manually run npm start
3.
npm WARN config init.module Use `--init-module` instead.
> [email protected] start
> fastify start ./built/index.js
SyntaxError: Unexpected strict mode reserved word
at ESMLoader.moduleStrategy (node:internal/modules/esm/translators:119:18)
at ESMLoader.moduleProvider (node:internal/modules/esm/loader:468:14)
OS:Ubuntu 20.04
206で返すやつ
iOSでの動画・音声の再生に必須
Related to misskey-dev/misskey#12881
related misskey-dev/misskey#10036
No file type reserved
config.jsにproxy: 'http://127.0.0.1:3128'
のように設定していてもhttpsで通信する場合プロキシを経由せず直接接続しています(config.jsから読み込まれていることは確認しました)
ipv4/ipv6ともにプロキシ設定を貫通しています
本体追従
The proxy will accept a target URL from query or the params part in the request, then it will download it even if the image if not coming from a Misskey instance in the federation.
That will cause a security issue that as a public proxy server, someone can easily abuse it to proxy something from any server, which might a harmful content, and the abusive behavior can also cause server traffic to be wasted, which can be used to launch malicious attacks on server instances with limited traffic.
Here is a possible solution to this issue:
The misskey instance knows which original servers the inbox receives media files from, and it must have an available URL to pull the original media files. Misskey instance can resolve the domain from the URL of media files, and add them to a whitelist automatically (the whitelist can be saved into DB, and use Redis or something other to notify the proxy that the whitelist should be reloaded), then the proxy can be secured by filter the URL with the domains in the whitelist.
Alternatively, it is also possible to check the domains of the individual instances within the federation, but this may not be as accurate (some instances may use different CDN domains).
(Actually, just add a simple signature can also make things better in a small cost way :D)
CORSヘッダーが無いとMisskey Web側で画像のクロップしようとしたときなどにエラーが出る
gotがデフォルトでUNIXドメインソケットを許容するので (現状は悪用できなそうだが) 拒否したほうが良さげ
misskey-dev/misskey#9802
Lambdaのメモリログを見ていると、リクエスト実行ごとに最大メモリ使用が増えている
Node.jsやFastifyの仕様なのか、このコードがダメなのかはわからない
README.mdを見ると、以下のように記載されています。
/proxyは画像ではないと403を返しますが、Media Proxyではそのまま内容を送信します。
https://github.com/misskey-dev/media-proxy/blob/master/src/index.ts#L206
しかし、ソースを見てみると、そうなっていないように見えます。
// 画像ではないもの、または、ブラウザセーフでないものの場合NGのような条件に見えます
} else if (!file.mime.startsWith('image/') || !FILE_TYPE_BROWSERSAFE.includes(file.mime)) {
throw new StatusError('Rejected type', 403, 'Rejected type');
// ----------------------------------------------------------------------------------------
// ブラウザセーフでないものの場合、403返す(こちらの動きが正しい?)
} else if (!FILE_TYPE_BROWSERSAFE.includes(file.mime)) {
throw new StatusError('Rejected type', 403, 'Rejected type');
意図通りではないなら修正したほうがいいと思います。
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.