fixed security issue by allowing only urls starting with http:// or https://

Author: jbenguira

API/REST/Screenshot.js

@@ -37,6 +37,14 @@ exports.handler = async (event, context, callback) => {
         url = decodeURIComponent(url);
     }
 
+    if ( !url.toLowerCase().startsWith("http://") && !url.toLowerCase().startsWith("https://") ){
+        callback(null, {
+            status: 400,
+            content: "Invalid URL, must start with http:// or https://"
+        });
+        return;
+    }
+
     var isFullPage = false; if ( event.queryStringParameters.isFullPage == "true" ) { isFullPage = true; }
     var resX = 1280; if ( event.queryStringParameters.resX != null ) { resX = event.queryStringParameters.resX; }
     var resY = 900; if ( event.queryStringParameters.resY != null ) { resY = event.queryStringParameters.resY; }

API/WS/Screenshot.js

@@ -61,6 +61,21 @@ exports.message = async (event, context, callback) => {
                 url = decodeURIComponent(url);
             }
 
+            if ( !url.toLowerCase().startsWith("http://") && !url.toLowerCase().startsWith("https://") ){
+                resp = {
+                    "cmd": "responseScreenshot",
+                    "data": "",
+                    "isEmptyResult": true,
+                    "execTime": "0ms",
+                    "totalScreenshots": sharedmem.getInteger("nbScreenshots"),
+                    "originalTS": obj.originalTS,
+                    "outFormat": obj.outFormat,
+                    "Content-Type": "application/json"
+                };
+                callback(null, JSON.stringify(resp));
+                return;
+            }
+
             //var screenshotResult = await tools.screnshotForUrl(url, true);
             var screenshotResult = null;
             try{