|
|
@@ -29,6 +29,7 @@ async function handle(
|
|
|
|
|
|
const requestUrl = new URL(req.url);
|
|
|
let endpoint = requestUrl.searchParams.get("endpoint");
|
|
|
+ let proxy_method = requestUrl.searchParams.get("proxy_method") || req.method;
|
|
|
|
|
|
// Validate the endpoint to prevent potential SSRF attacks
|
|
|
if (
|
|
|
@@ -65,7 +66,11 @@ async function handle(
|
|
|
const targetPath = `${endpoint}${endpointPath}`;
|
|
|
|
|
|
// only allow MKCOL, GET, PUT
|
|
|
- if (req.method !== "MKCOL" && req.method !== "GET" && req.method !== "PUT") {
|
|
|
+ if (
|
|
|
+ proxy_method !== "MKCOL" &&
|
|
|
+ proxy_method !== "GET" &&
|
|
|
+ proxy_method !== "PUT"
|
|
|
+ ) {
|
|
|
return NextResponse.json(
|
|
|
{
|
|
|
error: true,
|
|
|
@@ -78,7 +83,7 @@ async function handle(
|
|
|
}
|
|
|
|
|
|
// for MKCOL request, only allow request ${folder}
|
|
|
- if (req.method === "MKCOL" && !targetPath.endsWith(folder)) {
|
|
|
+ if (proxy_method === "MKCOL" && !targetPath.endsWith(folder)) {
|
|
|
return NextResponse.json(
|
|
|
{
|
|
|
error: true,
|
|
|
@@ -91,7 +96,7 @@ async function handle(
|
|
|
}
|
|
|
|
|
|
// for GET request, only allow request ending with fileName
|
|
|
- if (req.method === "GET" && !targetPath.endsWith(fileName)) {
|
|
|
+ if (proxy_method === "GET" && !targetPath.endsWith(fileName)) {
|
|
|
return NextResponse.json(
|
|
|
{
|
|
|
error: true,
|
|
|
@@ -104,7 +109,7 @@ async function handle(
|
|
|
}
|
|
|
|
|
|
// for PUT request, only allow request ending with fileName
|
|
|
- if (req.method === "PUT" && !targetPath.endsWith(fileName)) {
|
|
|
+ if (proxy_method === "PUT" && !targetPath.endsWith(fileName)) {
|
|
|
return NextResponse.json(
|
|
|
{
|
|
|
error: true,
|
|
|
@@ -118,7 +123,7 @@ async function handle(
|
|
|
|
|
|
const targetUrl = targetPath;
|
|
|
|
|
|
- const method = req.method;
|
|
|
+ const method = proxy_method || req.method;
|
|
|
const shouldNotHaveBody = ["get", "head"].includes(
|
|
|
method?.toLowerCase() ?? "",
|
|
|
);
|
|
|
@@ -143,7 +148,7 @@ async function handle(
|
|
|
"[Any Proxy]",
|
|
|
targetUrl,
|
|
|
{
|
|
|
- method: req.method,
|
|
|
+ method: method,
|
|
|
},
|
|
|
{
|
|
|
status: fetchResult?.status,
|