fix(offline-download): block cloud metadata endpoints

internal/net/serve.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"mime/multipart"
+	gonet "net"
 	"net/http"
 	"strconv"
 	"strings"
@@ -292,6 +293,31 @@ func NewHttpClient() *http.Client {
 
 	return &http.Client{
 		Timeout:   time.Hour * 48,
-		Transport: transport,
+		Transport: &safeTransport{base: transport},
 	}
 }
+
+type safeTransport struct {
+	base http.RoundTripper
+}
+
+func (t *safeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	host := req.URL.Hostname()
+	addrs, err := gonet.DefaultResolver.LookupIPAddr(req.Context(), host)
+	if err != nil || len(addrs) == 0 {
+		return nil, errors.Wrapf(err, "failed to resolve host: %s", host)
+	}
+	for _, addr := range addrs {
+		if isCloudMetadataIP(addr.IP) {
+			return nil, ErrCloudMetadataEndpoint
+		}
+	}
+	return t.base.RoundTrip(req)
+}
+
+var ErrCloudMetadataEndpoint = errors.New("access to cloud metadata endpoint is not allowed")
+
+func isCloudMetadataIP(ip gonet.IP) bool {
+	ip = ip.To4()
+	return ip != nil && ip[0] == 169 && ip[1] == 254 && ip[2] == 169 && ip[3] == 254
+}

internal/offline_download/115/client.go

@@ -62,18 +62,16 @@ func (p *Cloud115) AddURL(args *tool.AddUrlArgs) (string, error) {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only 115 Cloud is supported")
 	}
 
-	ctx := context.Background()
-
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
 
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 
-	hashs, err := driver115.OfflineDownload(ctx, []string{args.Url}, parentDir)
+	hashs, err := driver115.OfflineDownload(args.Ctx, []string{args.Url}, parentDir)
 	if err != nil || len(hashs) < 1 {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/115_open/client.go

@@ -58,18 +58,16 @@ func (o *Open115) AddURL(args *tool.AddUrlArgs) (string, error) {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only 115 Cloud is supported")
 	}
 
-	ctx := context.Background()
-
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
 
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 
-	hashs, err := driver115Open.OfflineDownload(ctx, []string{args.Url}, parentDir)
+	hashs, err := driver115Open.OfflineDownload(args.Ctx, []string{args.Url}, parentDir)
 	if err != nil || len(hashs) < 1 {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/123/client.go

@@ -58,15 +58,14 @@ func (*Pan123) AddURL(args *tool.AddUrlArgs) (string, error) {
 	if !ok {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only 123Pan is supported")
 	}
-	ctx := context.Background()
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
-	taskID, err := driver123.OfflineDownload(ctx, args.Url, parentDir)
+	taskID, err := driver123.OfflineDownload(args.Ctx, args.Url, parentDir)
 	if err != nil {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/123_open/client.go

@@ -56,16 +56,15 @@ func (*Open123) AddURL(args *tool.AddUrlArgs) (string, error) {
 	if !ok {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only 123 Open is supported")
 	}
-	ctx := context.Background()
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 	cb := setting.GetStr(conf.Pan123OpenOfflineDownloadCallbackUrl)
-	taskID, err := driver123Open.OfflineDownload(ctx, args.Url, parentDir, cb)
+	taskID, err := driver123Open.OfflineDownload(args.Ctx, args.Url, parentDir, cb)
 	if err != nil {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/http/client.go

@@ -11,13 +11,13 @@ import (
 
 	"github.com/OpenListTeam/OpenList/v4/drivers/base"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/net"
 	"github.com/OpenListTeam/OpenList/v4/internal/offline_download/tool"
 	"github.com/OpenListTeam/OpenList/v4/pkg/http_range"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 )
 
 type SimpleHttp struct {
-	client http.Client
 }
 
 func (s SimpleHttp) Name() string {
@@ -62,7 +62,7 @@ func (s SimpleHttp) Run(task *tool.DownloadTask) error {
 	if streamPut {
 		req.Header.Set("Range", "bytes=0-")
 	}
-	resp, err := s.client.Do(req)
+	resp, err := net.HttpClient().Do(req)
 	if err != nil {
 		return err
 	}

internal/offline_download/pikpak/pikpak.go

@@ -63,18 +63,16 @@ func (p *PikPak) AddURL(args *tool.AddUrlArgs) (string, error) {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only Pikpak is supported")
 	}
 
-	ctx := context.Background()
-
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
 
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 
-	t, err := pikpakDriver.OfflineDownload(ctx, args.Url, parentDir, "")
+	t, err := pikpakDriver.OfflineDownload(args.Ctx, args.Url, parentDir, "")
 	if err != nil {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/thunder/thunder.go

@@ -64,18 +64,16 @@ func (t *Thunder) AddURL(args *tool.AddUrlArgs) (string, error) {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only Thunder is supported")
 	}
 
-	ctx := context.Background()
-
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
 
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 
-	task, err := thunderDriver.OfflineDownload(ctx, args.Url, parentDir, "")
+	task, err := thunderDriver.OfflineDownload(args.Ctx, args.Url, parentDir, "")
 	if err != nil {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/thunder_browser/thunder_browser.go

@@ -63,23 +63,21 @@ func (t *ThunderBrowser) AddURL(args *tool.AddUrlArgs) (string, error) {
 		return "", err
 	}
 
-	ctx := context.Background()
-
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
 
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 
 	var task *thunder_browser.OfflineTask
 	switch v := storage.(type) {
 	case *thunder_browser.ThunderBrowser:
-		task, err = v.OfflineDownload(ctx, args.Url, parentDir, "")
+		task, err = v.OfflineDownload(args.Ctx, args.Url, parentDir, "")
 	case *thunder_browser.ThunderBrowserExpert:
-		task, err = v.OfflineDownload(ctx, args.Url, parentDir, "")
+		task, err = v.OfflineDownload(args.Ctx, args.Url, parentDir, "")
 	default:
 		return "", fmt.Errorf("unsupported storage driver for offline download, only ThunderBrowser is supported")
 	}

internal/offline_download/thunderx/thunderx.go

@@ -58,18 +58,16 @@ func (t *ThunderX) AddURL(args *tool.AddUrlArgs) (string, error) {
 		return "", fmt.Errorf("unsupported storage driver for offline download, only ThunderX is supported")
 	}
 
-	ctx := context.Background()
-
-	if err := op.MakeDir(ctx, storage, actualPath); err != nil {
+	if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
 		return "", err
 	}
 
-	parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
+	parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
 	if err != nil {
 		return "", err
 	}
 
-	task, err := thunderXDriver.OfflineDownload(ctx, args.Url, parentDir, "")
+	task, err := thunderXDriver.OfflineDownload(args.Ctx, args.Url, parentDir, "")
 	if err != nil {
 		return "", fmt.Errorf("failed to add offline download task: %w", err)
 	}

internal/offline_download/tool/base.go

@@ -1,6 +1,8 @@
 package tool
 
 import (
+	"context"
+
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
 )
 
@@ -9,6 +11,7 @@ type AddUrlArgs struct {
 	UID     string
 	TempDir string
 	Signal  chan int
+	Ctx     context.Context
 }
 
 type Status struct {

internal/offline_download/tool/download.go

@@ -54,6 +54,7 @@ func (t *DownloadTask) Run() error {
 		t.Signal = nil
 	}()
 	gid, err := t.tool.AddURL(&AddUrlArgs{
+		Ctx:     t.Ctx(),
 		Url:     t.Url,
 		UID:     t.ID,
 		TempDir: t.TempDir,

internal/offline_download/transmission/client.go

@@ -9,9 +9,11 @@ import (
 	"net/url"
 	"strconv"
 
+	"github.com/OpenListTeam/OpenList/v4/drivers/base"
 	"github.com/OpenListTeam/OpenList/v4/internal/conf"
 	"github.com/OpenListTeam/OpenList/v4/internal/errs"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/net"
 	"github.com/OpenListTeam/OpenList/v4/internal/offline_download/tool"
 	"github.com/OpenListTeam/OpenList/v4/internal/setting"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
@@ -84,7 +86,12 @@ func (t *Transmission) AddURL(args *tool.AddUrlArgs) (string, error) {
 	}
 	// http url for .torrent file
 	if endpoint.Scheme == "http" || endpoint.Scheme == "https" {
-		resp, err := http.Get(args.Url)
+		resp, err := net.RequestHttp(
+			args.Ctx,
+			http.MethodGet,
+			http.Header{"User-Agent": []string{base.UserAgent}},
+			args.Url,
+		)
 		if err != nil {
 			return "", errors.Wrap(err, "failed to get .torrent file")
 		}
@@ -106,7 +113,7 @@ func (t *Transmission) AddURL(args *tool.AddUrlArgs) (string, error) {
 		rpcPayload.Filename = &args.Url
 	}
 
-	torrent, err := t.client.TorrentAdd(context.TODO(), rpcPayload)
+	torrent, err := t.client.TorrentAdd(args.Ctx, rpcPayload)
 	if err != nil {
 		return "", err
 	}
@@ -123,7 +130,7 @@ func (t *Transmission) Remove(task *tool.DownloadTask) error {
 	if err != nil {
 		return err
 	}
-	err = t.client.TorrentRemove(context.TODO(), transmissionrpc.TorrentRemovePayload{
+	err = t.client.TorrentRemove(task.Ctx(), transmissionrpc.TorrentRemovePayload{
 		IDs:             []int64{gid},
 		DeleteLocalData: false,
 	})
@@ -135,7 +142,7 @@ func (t *Transmission) Status(task *tool.DownloadTask) (*tool.Status, error) {
 	if err != nil {
 		return nil, err
 	}
-	infos, err := t.client.TorrentGetAllFor(context.TODO(), []int64{gid})
+	infos, err := t.client.TorrentGetAllFor(task.Ctx(), []int64{gid})
 	if err != nil {
 		return nil, err
 	}