CVE-2024-27926 (TypeScript, published 2024-03-21T02:52Z)
Description: value: RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version 1.0.0-master.d8ca915. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/DIYgod/RSSHub
Files changed:
lib/config.ts
lib/routes/rsshub/maintainer.ts
lib/routes/rsshub/router.ts
lib/routes/telegram/channel.ts
lib/routes/telegram/tglib/channel.ts
lib/routes/telegram/tglib/client.ts
lib/routes/weibo/timeline.ts
website/docs/install/config.md
website/docs/routes/other.mdx
website/docs/routes/social-media.mdx
website/i18n/zh/docusaurus-plugin-content-docs/current/install/config.md
Commit message: feat: remove MEDIA_PROXY_KEY and internal media proxy


Vulnerable code:
        mediaProxyKey?: string;
            mediaProxyKey: envs.MEDIA_PROXY_KEY,
    '/m/:key/:url': ['TonyRL'],
// @ts-nocheck
import got from '@/utils/got';
import { config } from '@/config';
const { getDomain } = require('tldts');
const { refererMap } = require('./referer-map');

export default async (ctx) => {
    if (!config.feature.mediaProxyKey) {
        throw new Error('Internal media proxy is disabled.');
    }

    const key = ctx.req.param('key');
    if (key !== config.feature.mediaProxyKey) {
        throw new Error('Invalid media proxy key.');
    }

    const url = decodeURIComponent(ctx.req.param('url'));
    const requestUrl = new URL(url);
    const { hostname, origin } = requestUrl;

    const domain = getDomain(hostname);

    let referer = refererMap.get(domain);
    referer ||= origin;

    const { headers } = await got.head(url, {
        headers: {
            referer,
        },
    });

    const cacheControl = headers['cache-control'];
    const contentType = headers['content-type'];
    const contentLength = headers['content-length'];

    if (!contentType.startsWith('image/') || headers.server === 'RSSHub') {
        return ctx.redirect(url);
    }

    ctx.set({
        'cache-control': cacheControl || `public, max-age=${config.cache.contentExpire}`,
        'content-length': contentLength,
        'content-type': contentType,
        server: 'RSSHub',
    });

    ctx.body = await got.stream(url, {
        headers: {
            referer,
        },
    });
};
    router.get('/m/:key/:url', './media');
    const useWeb = ctx.req.param('routeParams') || !(config.telegram.session && config.feature.mediaProxyKey);
    if (ctx.req.param('key') !== config.feature.mediaProxyKey) {
        throw new Error('Invalid key');
    }

    const base = `${ctx.protocol}://${ctx.host}/telegram/channel/${channelName}/${config.feature.mediaProxyKey}/`;
            ctx.body = `<script>window.location = '/weibo/timeline/${uid}${routeParams ? `/${routeParams}` : ''}'</script>`;
`MEDIA_PROXY_KEY`: the access key for internal media proxy.

### Macao Pagina Electrónica Especial Contra Epidemias: What’s New {#corona-virus-disease-2019-macao-pagina-electr%C3%B3nica-especial-contra-epidemias-what-s-new}
### Internal Media Proxy {#rsshub-internal-media-proxy}

<Route author="TonyRL" example="/rsshub/m/key/https%3A%2F%2Fdocs.rsshub.app%2Fimg%2Flogo.png" path="/rsshub/m/:key/:url" paramsDesc={['Media Proxy Key', '`encodeURIComponent`ed URL address']} configRequired="1" />

This route requires user-based `TELEGRAM_SESSION` which can be acquired and `MEDIA_PROXY_KEY`.
`MEDIA_PROXY_KEY`: 内置多媒体代理的访问密钥


Fixed code:
    const useWeb = ctx.req.param('routeParams') || !config.telegram.session;
    const base = `${ctx.protocol}://${ctx.host}/telegram/channel/${channelName}`;
            ctx.html(`<script>window.location = '/weibo/timeline/${uid}${routeParams ? `/${routeParams}` : ''}'</script>`);
### Macao Pagina Electrónica Especial Contra Epidemias: What’s New {#corona-virus-disease-2019-macao-pagina-electronica-especial-contra-epidemias-what-s-new}
This route requires user-based `TELEGRAM_SESSION`.