fix: sanitize IPFS URLs before processing

- Ensure nameOp.nameValue is properly sanitized before IPFS processing - Add HTML sanitization to prevent potential XSS attacks - Only process values that start with 'ipfs://' after sanitization
silkroadnomad · Jan 18, 2025 · cdf1a26 · cdf1a26
1 parent 469ad40
commit cdf1a26
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/relay/package.json b/relay/package.json
@@ -1,6 +1,6 @@
 {
   "name": "libp2p-relay",
-  "version": "0.12.19",
+  "version": "0.12.22",
   "private": true,
   "scripts": {
     "start:no-restart": "node src/relay.js",

diff --git a/relay/src/pinner/nameOpsFileManager.js b/relay/src/pinner/nameOpsFileManager.js
@@ -27,7 +27,7 @@ class OrbitDBInterface {
     const dbPath = './orbitdb/nameops';
 
     // Clean up any stale lock files before opening
-    await this.cleanupLockFiles(dbPath);
+    await cleanupLockFiles(dbPath);
 
     this.db = await this.orbitdb.open(dbName, {
       type: 'documents',

diff --git a/relay/src/pinner/scanBlockchainForNameOps.js b/relay/src/pinner/scanBlockchainForNameOps.js
@@ -180,7 +180,7 @@ async function processBlocks(
             allowedAttributes: {},
           });
 
-          if (sanitizedValue && !sanitizedValue.startsWith('ipfs://')) {
+          if (sanitizedValue && sanitizedValue.startsWith('ipfs://')) {
             // Use the pinQueue for pinIpfsContent operation
             // TODO: sanitize metadata before pinning
             pinQueue.add(() =>
@@ -208,9 +208,9 @@ async function processBlocks(
                 })
             );
           } else {
-            logger.warn(
-              `Invalid or potentially harmful nameValue detected: ${nameOp.nameValue}`
-            );
+            // logger.warn(
+            //   `Invalid or potentially harmful nameValue detected: ${nameOp.nameValue}`
+            // );
           }
         }
       } else {