openclawd/SnapAPI
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: return 400 for invalid protocols and unresolvable hostnames (was 500)
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m41s
Details

Browse source
This commit is contained in:
OpenClawd 2026-02-24 14:00:55 +00:00
parent 5ec8c92413
commit b07b9cfd25
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/routes/playground.ts
View file

@ -136,7 +136,7 @@ playgroundRouter.post("/", playgroundLimiter, async (req, res) => {
res.status(504).json({ error: "Screenshot timed out." }); res.status(504).json({ error: "Screenshot timed out." });
return; return;
} }
if (err.message.includes("blocked") || err.message.includes("not allowed") || err.message.includes("Invalid URL")) { if (err.message.includes("blocked") || err.message.includes("not allowed") || err.message.includes("Invalid URL") || err.message.includes("Could not resolve")) {
res.status(400).json({ error: err.message }); res.status(400).json({ error: err.message });
return; return;
} }

2
src/routes/screenshot.ts
View file

@ -352,7 +352,7 @@ async function handleScreenshotRequest(req: any, res: any) {
res.status(504).json({ error: "Screenshot timed out. The page may be too slow to load." }); res.status(504).json({ error: "Screenshot timed out. The page may be too slow to load." });
return; return;
} }
if (err.message.includes("blocked") || err.message.includes("not allowed") || err.message.includes("Invalid URL")) { if (err.message.includes("blocked") || err.message.includes("not allowed") || err.message.includes("Invalid URL") || err.message.includes("Could not resolve")) {
res.status(400).json({ error: err.message }); res.status(400).json({ error: err.message });
return; return;
} }

2
src/services/ssrf.ts
View file

@ -39,7 +39,7 @@ export async function validateUrl(urlStr: string): Promise<{ hostname: string; r
} }
if (!["http:", "https:"].includes(parsed.protocol)) { if (!["http:", "https:"].includes(parsed.protocol)) {
throw new Error("Only HTTP and HTTPS URLs are allowed"); throw new Error("URL protocol not allowed: only HTTP and HTTPS are supported");
} }
const hostname = parsed.hostname; const hostname = parsed.hostname;