golem15/sm-seo-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: the crawler and the Chrome guard keep to the site's port

Browse Source 
Fetcher.Allowed and Key, the rendered comparison and the Chrome request
guard accept an address only on the site's effective port (explicit,
else 443 for https and 80 for http), so page code cannot make headless
Chrome reach other services on the site host's address and a link to
another port is not reported as a page of the site.
This commit is contained in:
Jakub Zych
2026-11-04 22:56:02 +01:00
parent cfeb3dff12
commit 3fdb44bce2
9 changed files with 138 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
classes/crawl/render_chrome.go
View File

@@ -29,7 +29,7 @@ import (
// fetchguard.IsPrivateAddr; every other host resolves to NOTFOUND;
// - every request is paused through the Fetch domain and continued only
// when allowRequest passes (https, http only in trusted mode, to an
// allowed host, or data: and blob:); the others fail with
// allowed host on the site's port, or data: and blob:); the others fail with
// BlockedByClient, so third-party scripts are never loaded;
// - a fresh temporary profile per crawl, removed by Close; no cookies,
// credentials or extensions; downloads denied;
@@ -43,6 +43,7 @@ import (
// added that weakens Chrome's sandbox.
type chromeRenderer struct {
allowed []string
port string
trusted bool
profile string
@@ -75,13 +76,13 @@ func seconds(d time.Duration) string {
}
// newChromeRenderer starts Chrome at path for the hosts and their checked
// addresses.
func newChromeRenderer(path string, hosts map[string][]netip.Addr, trusted bool, ua string) (*chromeRenderer, error) {
// addresses, on the site's effective port.
func newChromeRenderer(path string, hosts map[string][]netip.Addr, port string, trusted bool, ua string) (*chromeRenderer, error) {
profile, err := os.MkdirTemp("", "summercms-seo-chrome-")
if err != nil {
return nil, fmt.Errorf("the Chrome profile cannot be created: %w", err)
}
r := &chromeRenderer{trusted: trusted, profile: profile}
r := &chromeRenderer{port: port, trusted: trusted, profile: profile}
for h := range hosts {
r.allowed = append(r.allowed, h)
}
@@ -117,7 +118,7 @@ func (r *chromeRenderer) Render(ctx context.Context, pageURL string) (string, er
if closed {
return "", fmt.Errorf("Chrome is closed")
}
if !allowRequest(pageURL, r.allowed, r.trusted) {
if !allowRequest(pageURL, r.allowed, r.port, r.trusted) {
return "", fmt.Errorf("the address %s is outside the site", pageURL)
}
// One deadline bounds opening the tab and rendering the page; the tab
@@ -206,7 +207,7 @@ func (r *chromeRenderer) decide(ctx context.Context, target cdp.Session, ev fetc
if ev.Request != nil {
u = ev.Request.URL
}
if allowRequest(u, r.allowed, r.trusted) {
if allowRequest(u, r.allowed, r.port, r.trusted) {
_, _ = cdp.Call(ctx, target, fetch.ContinueRequest, fetch.ContinueRequestParams{RequestID: ev.RequestID})
return
}