fix: allow upgrading HTTP to HTTPS for redirects #3978
Merged
+8
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Re: advplyr#3142 and advplyr#3658 When adding certain podcasts, the server encountered a redirect from an HTTP URL to an HTTPS domain, causing an error that was difficult for end users to diagnose without inspecting logs or HTML. This issue arose due to SSRF security measures that blocked such redirects. Instead of failing in these cases, we now detect when the error is caused by an HTTP-to-HTTPS upgrade. If confirmed, we upgrade the initial URL to HTTPS and resend the request. Since this change does not allow cross-protocol or cross-domain redirections, it remains secure while resolving most of the reported issues. Affected podcasts that are now fixed: - D&D is for Nerds - The New Yorker: The Writer's Voice - New Fiction from The New Yorker - Radiolab
|
I'm also encountering this issue. Seems like it would be a simple change. Yes? |
|
Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Brief Summary
Allow adding podcasts where the server detects an
httpdomain and redirects to anhttpsdomain. Currently, these fail with an error message that is not useful to the end user.Which Issue is Fixed?
Fixes #3142
Fixes #3658
In-Depth Description
This error occurs for several mainstream podcasts, likely impacting multiple users. I lost some spouse approval points due to this issue. 😅
The root cause is that we are not allowing the Axios client to redirect between domains with different protocols. As a result, any feed URL detected as
httpthat redirects to a differenthttpsdomain would fail, leaving users without a clear resolution.The Fix
httptohttps.httpsand retry the request.httpsversion or another protocol change occurs (e.g.,https→http), the request will still fail, ensuring we do not introduce security risks.How Have You Tested This?
I confirmed that the following podcasts were failing to add in the current version (
v2.19.2) of Audiobookshelf.After making my changes, I was able to successfully add all three podcasts through the UI: