feat: add url validation to download attatchment endpoint

apps/web/src/pages/api/download/attatchment.ts

@@ -2,6 +2,8 @@ import type { NextApiRequest, NextApiResponse } from "next";
 
 import { withRateLimit } from "@kan/api/utils/rateLimit";
 
+import { env } from "~/env";
+
 export default withRateLimit(
   { points: 100, duration: 60 },
   async (req: NextApiRequest, res: NextApiResponse) => {
@@ -12,22 +14,44 @@ export default withRateLimit(
     const { url, filename } = req.query;
 
     if (!url || typeof url !== "string") {
-    return res.status(400).json({
-      message: "url parameter is required",
-    });
+      return res.status(400).json({ message: "url parameter is required" });
+    }
+
+    const s3Endpoint = env.S3_ENDPOINT;
+
+    if (s3Endpoint) {
+      let parsed: URL;
+      try {
+        parsed = new URL(url);
+      } catch {
+        return res.status(400).json({ message: "Invalid URL" });
+      }
+
+      const hostname = parsed.hostname.toLowerCase();
+      let allowedHost: string;
+      try {
+        allowedHost = new URL(s3Endpoint).hostname.toLowerCase();
+      } catch {
+        return res.status(500).json({ message: "Storage endpoint misconfigured" });
+      }
+
+      if (hostname !== allowedHost && !hostname.endsWith(`.${allowedHost}`)) {
+        return res.status(403).json({ message: "URL not allowed" });
+      }
     }
 
     try {
-    const downloadFilename = typeof filename === "string"
+      const downloadFilename =
+        typeof filename === "string"
           ? encodeURIComponent(filename)
           : "attachment";
 
       const upstream = await fetch(url);
 
       if (!upstream.ok) {
-      return res.status(upstream.status).json({
-        message: "Failed to fetch attachment",
-      });
+        return res
+          .status(upstream.status)
+          .json({ message: "Failed to fetch attachment" });
       }
 
       const contentType =
@@ -43,7 +67,9 @@ export default withRateLimit(
       return res.send(Buffer.from(buffer));
     } catch (error) {
       console.error("Error downloading attachment:", error);
-    return res.status(500).json({ message: "Failed to download attachment" });
+      return res
+        .status(500)
+        .json({ message: "Failed to download attachment" });
     }
   },
 );