Any recommendations for sanitizing a URL string before inserting it into a HTML string template?

Ddave Any recommendations for sanitizing a URL string before inserting it into a HTML ...

H

Hard@Work•7/29/24, 2:02 PM

URLEncoding it?

HHard@Work URLEncoding it?

D

daveOP•7/29/24, 2:14 PM

so just

encodeURI

encodeURI

?

Ddave so just `encodeURI`?

H

Hard@Work•7/29/24, 2:15 PM

Sure? Not entirely sure what input you are expecting/how you are using it. Is it visible content for the user? Is it part of a script?

HHard@Work Try `CI=1`

D

daveOP•7/29/24, 2:49 PM

sadly this removes the color output on the terminal;

export CF_PAGES=1

export CF_PAGES=1

works perfectly though, confirmed!

HHard@Work Sure? Not entirely sure what input you are expecting/how you are using it. Is it...

D

daveOP•7/29/24, 3:39 PM

Is it visible content for the user?

Yes.

Is it part of a script?

Yes.

HHard@Work Sure? Not entirely sure what input you are expecting/how you are using it. Is it...

D

daveOP•7/29/24, 3:39 PM

It's a redirecter for email analytics.

Ddave It's a redirecter for email analytics.

H

Hard@Work•7/29/24, 3:40 PM

And the string you are inserting, is it the email of the user, or...?

H

Hard@Work•7/29/24, 3:40 PM

Can you validate it with a regex/some sort of schema?

HHard@Work And the string you are inserting, is it the email of the user, or...?

D

daveOP•7/29/24, 4:01 PM

hang on, lemme just show ya:

curl "https://removed"

curl "https://removed"

Ddave hang on, lemme just show ya: ```sh curl "https://removed" ```

H

Hard@Work•7/29/24, 5:15 PM

Am I supposed to curl that, or...

HHard@Work Am I supposed to curl that, or...

D

daveOP•7/29/24, 5:15 PM

ya, curl that

Ddave ya, curl that

H

Hard@Work•7/29/24, 5:18 PM

I see some HTML?

H

Hard@Work•7/29/24, 5:18 PM

Is there a specific field?

HHard@Work Is there a specific field?

D

daveOP•7/29/24, 5:22 PM

This is basically the code:

const destination_url_without_query_encoded = encodeURI(new URL(...untrusted...).href);
const encoded_url = encodeURI(new URL(...untrusted...).href);

const html_body = `<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="refresh" content="0;url=${encoded_url}">
  <title>Redirecting...</title>
  <meta http-equiv="Cache-Control" content="private, no-transform, no-cache, no-store, max-age=0, s-maxage=0">
  <link rel="canonical" href="${destination_url_without_query_encoded}" />
  <meta name="robots" content="noindex, nofollow, notranslate, noarchive, noimageindex, nosnippet, nositelinkssearchbox, nocache, nopagereadaloud">
</head>
<body>
  <h1>Redirecting...</h1>
  <p>If you are not redirected automatically, please <a href="${encoded_url}">click here</a>.</p>
  <script>
    window.location.replace = "${encoded_url}";
  </script>
</body>
</html>
`;

const destination_url_without_query_encoded = encodeURI(new URL(...untrusted...).href);
const encoded_url = encodeURI(new URL(...untrusted...).href);

const html_body = `<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="refresh" content="0;url=${encoded_url}">
  <title>Redirecting...</title>
  <meta http-equiv="Cache-Control" content="private, no-transform, no-cache, no-store, max-age=0, s-maxage=0">
  <link rel="canonical" href="${destination_url_without_query_encoded}" />
  <meta name="robots" content="noindex, nofollow, notranslate, noarchive, noimageindex, nosnippet, nositelinkssearchbox, nocache, nopagereadaloud">
</head>
<body>
  <h1>Redirecting...</h1>
  <p>If you are not redirected automatically, please <a href="${encoded_url}">click here</a>.</p>
  <script>
    window.location.replace = "${encoded_url}";
  </script>
</body>
</html>
`;

const destination_url_without_query_encoded = encodeURI(new URL(...untrusted...).href);
const encoded_url = encodeURI(new URL(...untrusted...).href);

const html_body = `<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="refresh" content="0;url=${encoded_url}">
  <title>Redirecting...</title>
  <meta http-equiv="Cache-Control" content="private, no-transform, no-cache, no-store, max-age=0, s-maxage=0">
  <link rel="canonical" href="${destination_url_without_query_encoded}" />
  <meta name="robots" content="noindex, nofollow, notranslate, noarchive, noimageindex, nosnippet, nositelinkssearchbox, nocache, nopagereadaloud">
</head>
<body>
  <h1>Redirecting...</h1>
  <p>If you are not redirected automatically, please <a href="${encoded_url}">click here</a>.</p>
  <script>
    window.location.replace = "${encoded_url}";
  </script>
</body>
</html>
`;

const destination_url_without_query_encoded = encodeURI(new URL(...untrusted...).href);
const encoded_url = encodeURI(new URL(...untrusted...).href);

const html_body = `<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="refresh" content="0;url=${encoded_url}">
  <title>Redirecting...</title>
  <meta http-equiv="Cache-Control" content="private, no-transform, no-cache, no-store, max-age=0, s-maxage=0">
  <link rel="canonical" href="${destination_url_without_query_encoded}" />
  <meta name="robots" content="noindex, nofollow, notranslate, noarchive, noimageindex, nosnippet, nositelinkssearchbox, nocache, nopagereadaloud">
</head>
<body>
  <h1>Redirecting...</h1>
  <p>If you are not redirected automatically, please <a href="${encoded_url}">click here</a>.</p>
  <script>
    window.location.replace = "${encoded_url}";
  </script>
</body>
</html>
`;

Ddave This is basically the code: ```typescript const destination_url_without_query_e...

H

Hard@Work•7/29/24, 5:25 PM

And this is for interaction tracking? If you are the one generating the URLs, maybe you could add some kind of validation step?

HHard@Work And this is for interaction tracking? If you are the one generating the URLs, ma...

D

daveOP•7/29/24, 5:26 PM

Yes. And no, it's AWS SES that's generating the URLs. I have put a Worker in front of the redirect page though.

WWalshy $0

J

justinO•7/29/24, 8:09 PM

Thank you and apologies @Chaika I was unaware

B

byte•7/30/24, 7:28 AM

I am currently writing a kv tool function. Now I can only get the instance in env. Does anyone know of other ways to get an instance? I don't want to mix utility functions with env.

M

marsoleg•7/30/24, 9:00 AM

Hi, my program needs to do caching to work. I read upstash documentation and liked it. But I don't understand why it uses Rest API instead of TCP, even though Cloudflare supports it. Also, I'd be glad if you tell me more about caching methods in Cloudflare Workers.

E

Erisa•7/30/24, 9:32 AM

upstash support for workers has been around for much longer than tcp support has been and frankly sending off a fetch is still a lot easier to explain, so they probably never found benefit in providing guides for tcp. it should work just fine though, if you work out how to interact with redis over a raw tcp socket

J

Jonathan Silva•7/31/24, 2:36 AM

To use module workers do I need the wrangler.toml file ?

I create the Worker via API and it is not possible to create this file

What I'm trying to do is connect to D1

P

Ping for toast•7/31/24, 4:20 PM

anybody having latency issues with cloudflare?

P

Ping for toast•7/31/24, 4:21 PM

might have been fixed now but

P

Ping for toast•7/31/24, 4:21 PM

PPing for toast Click to see attachment

C

Chaika•7/31/24, 4:21 PM

are you near germany?

C

Chaika•7/31/24, 4:21 PM

https://www.cloudflarestatus.com/incidents/tc5hqzg2fv6s

Network Performance Issues in Frankfurt

CChaika are you near germany?

P

Ping for toast•7/31/24, 4:21 PM

database is in frankfurt, connecting via hyperdrive to it from US east

C

Chaika•7/31/24, 4:21 PM

probably related to that then

P

Ping for toast•7/31/24, 4:22 PM

would this incident impact that

P

Ping for toast•7/31/24, 4:22 PM

yeah

C

Chaika•7/31/24, 4:22 PM

I think hyperdrive uses smart routing/argo?

C

Chaika•7/31/24, 4:22 PM

well if it's already resolved safe bet it was that, since they said fix implemented/just started recently

CChaika I think hyperdrive uses smart routing/argo?

P

Ping for toast•7/31/24, 4:23 PM

yeah, back to expectedly (high) latencies 5 minutes or so ago

P

Ping for toast•7/31/24, 4:24 PM

returned to normal at 12:19

Original message was deleted

P

Ping for toast•7/31/24, 4:26 PM

man im honestly surprised how quiet all this was

P

Ping for toast•7/31/24, 4:26 PM

is everything really virginia

J

Jonathan Silva•7/31/24, 9:13 PM

Generates error when creating a Worker via API

Error
"Uncaught SyntaxError: Unexpected token 'export'\n at worker.js:141\n"

New code:

export default {
    async fetch(request, env, ctx) {
        const url = new URL(request.url);

        if (url.pathname === ENDPOINT) {
            handle(request, url);
        }
    }
}

export default {
    async fetch(request, env, ctx) {
        const url = new URL(request.url);

        if (url.pathname === ENDPOINT) {
            handle(request, url);
        }
    }
}

export default {
    async fetch(request, env, ctx) {
        const url = new URL(request.url);

        if (url.pathname === ENDPOINT) {
            handle(request, url);
        }
    }
}

export default {
    async fetch(request, env, ctx) {
        const url = new URL(request.url);

        if (url.pathname === ENDPOINT) {
            handle(request, url);
        }
    }
}

It worked with:

addEventListener("fetch", event => {
    const url = new URL(event.request.url);

    if (url.pathname === ENDPOINT) {
        event.respondWith(handle(event, url));
    }
});

addEventListener("fetch", event => {
    const url = new URL(event.request.url);

    if (url.pathname === ENDPOINT) {
        event.respondWith(handle(event, url));
    }
});

addEventListener("fetch", event => {
    const url = new URL(event.request.url);

    if (url.pathname === ENDPOINT) {
        event.respondWith(handle(event, url));
    }
});

addEventListener("fetch", event => {
    const url = new URL(event.request.url);

    if (url.pathname === ENDPOINT) {
        event.respondWith(handle(event, url));
    }
});

J

Jonathan Silva•7/31/24, 9:43 PM

I create the Worker with this endpoint

J

Jonathan Silva•7/31/24, 9:43 PM

https://developers.cloudflare.com/api/operations/worker-script-upload-worker-module

K

kian•7/31/24, 11:14 PM

K

kian•7/31/24, 11:14 PM

You need to use form-data to use Module Workers

K

kian•7/31/24, 11:14 PM

J

Jonathan Silva•7/31/24, 11:44 PM

Thanks, I'll try here
I will have to redo the entire request

P

Ping for toast•8/1/24, 2:18 AM

For cloudflare verified bots, is there a way that a request coming from a cloudflare worker can be verified as obviously I do not own the IP?

P

Ping for toast•8/1/24, 2:19 AM

if not I could look into making these requests from a VPS with a fixed IP instead

P

Ping for toast•8/1/24, 2:25 AM

oh I might not be eligible at this scale

Lastly, if you work at a startup, your company may run automated services that haven’t reached the scale we require. But you still need a way to allowlist these services.

I crawl sites to generate page previews in response to user action, and I've been getting a lot of titles back as "Just a moment..."

P

Ping for toast•8/1/24, 2:27 AM

oh that makes me think... something cloudflare could do is expose opengraph metadata on pages to bot operators, because thats all I need and also it exists specifically for bots

R

rbravo•8/1/24, 3:23 AM

Can I have multiple consumers in one Worker, each one processing different queues?

Context:

I'm reading this in the docs:

Best practice
Configure a single consumer per queue. This both logically separates your queues, and ensures that errors (failures) in processing messages from one queue do not impact your other queues.

Rrbravo Can I have multiple consumers in one Worker, each one processing different queue...

P

Ping for toast•8/1/24, 5:30 AM

It is my understanding that you can have a single worker reading ("consuming") multiple queues, but a single queue should only be read by one worker

P

Ping for toast•8/1/24, 5:33 AM

Any recommendations for sanitizing a URL string before inserting it into a HTML string template?

Similar Threads

Similar Threads

Similar Threads