starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 16:35:53 +02:00

[GH-ISSUE #204] Web app: validate server URLs #160

New issue

Closed

opened 2026-05-07 00:20:49 +02:00 by BreizhHardware · 6 comments

BreizhHardware commented

2026-05-07 00:20:49 +02:00

Owner

Originally created by @cmeis on GitHub (Apr 8, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/204

As in issue #193 for the Android app, the web app doesn't do any validation on the server url for user accounts (apart from it having to be at least one character long ;-) ). See screenshot:

Needs proper input validation for the URL.

Originally created by @cmeis on GitHub (Apr 8, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/204 As in issue #193 for the Android app, the web app doesn't do any validation on the server url for user accounts (apart from it having to be at least one character long ;-) ). See screenshot: ![Screenshot 2022-04-08 235839](https://user-images.githubusercontent.com/1850168/162537524-6e15d62d-bb03-4d25-9f6e-0e7ce2e12db2.png) Needs proper input validation for the URL.

BreizhHardware

2026-05-07 00:20:49 +02:00

closed this issue
added the
🪲 bug

web-app
labels

BreizhHardware commented

2026-05-07 00:20:50 +02:00

Author

Owner

@binwiederhier commented on GitHub (Apr 8, 2022):

Indeed. 😱

Good catch.

@binwiederhier commented on GitHub (Apr 8, 2022): Indeed. :scream: Good catch.

BreizhHardware commented

2026-05-07 00:20:50 +02:00

Author

Owner

@binwiederhier commented on GitHub (Apr 8, 2022):

There isn't really much validation I can do apart from just checking that it starts with https?:// -- If I was gonna get fancy, I could make an endpoint to check that the server is a valid ntfy server, but that's not really worth it, so I think I'll stick with the http/s-chekc

@binwiederhier commented on GitHub (Apr 8, 2022): There isn't really much validation I can do apart from just checking that it starts with `https?://` -- If I was gonna get fancy, I could make an endpoint to check that the server is a valid ntfy server, but that's not really worth it, so I think I'll stick with the http/s-chekc

BreizhHardware commented

2026-05-07 00:20:50 +02:00

Author

Owner

@cmeis commented on GitHub (Apr 9, 2022):

Well you could validate the host a bit more, like:

is it a valid IPv4/IPv6 address?
is it a syntactically correct FQDN?

Perhaps something like https://www.npmjs.com/package/is-valid-hostname

@cmeis commented on GitHub (Apr 9, 2022): Well you could validate the host a bit more, like: - is it a valid IPv4/IPv6 address? - is it a syntactically correct FQDN? Perhaps something like https://www.npmjs.com/package/is-valid-hostname

BreizhHardware commented

2026-05-07 00:20:50 +02:00

Author

Owner

@binwiederhier commented on GitHub (Apr 9, 2022):

is-valid-hostname reminded me of the left-pad debacle. I generally try to keep dependencies out as much as possible (though that's hard to do in the JS world). But hostname checking doesn't have to be that strict. If it's wrong, stuff will not work and you'll fix it. :-D

I think I'm alright with just checking for http://..

@binwiederhier commented on GitHub (Apr 9, 2022): [is-valid-hostname](https://www.npmjs.com/package/is-valid-hostname) reminded me of the `left-pad` debacle. I generally try to keep dependencies out as much as possible (though that's hard to do in the JS world). But hostname checking doesn't have to be that strict. If it's wrong, stuff will not work and you'll fix it. :-D I think I'm alright with just checking for http://..

BreizhHardware commented

2026-05-07 00:20:51 +02:00

Author

Owner

@cmeis commented on GitHub (Apr 9, 2022):

Tell me about dependency hell..... I'm fine with fixing my own sh*t 😉

@cmeis commented on GitHub (Apr 9, 2022): Tell me about dependency hell..... I'm fine with fixing my own sh*t 😉

BreizhHardware commented

2026-05-07 00:20:51 +02:00

Author

Owner

@binwiederhier commented on GitHub (Apr 10, 2022):

This is done and will be in the next release. Just basic URL validation

@binwiederhier commented on GitHub (Apr 10, 2022): This is done and will be in the next release. Just basic URL validation