From 74a247fc5c4e458f1aed118ed346f7ec53de5c3d Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Thu, 17 Feb 2022 22:38:38 +0300
Subject: [PATCH] rewrite_relative: whitelist specific schemes for URLs with
 'known' content-types i.e. specified for enclosures

---
 classes/rssutils.php  |  2 +-
 classes/urlhelper.php | 17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/classes/rssutils.php b/classes/rssutils.php
index d7284a7bc..9995b0e43 100755
--- a/classes/rssutils.php
+++ b/classes/rssutils.php
@@ -736,7 +736,7 @@ class RSSUtils {
 
 						// TODO: Just use FeedEnclosure (and modify it to cover whatever justified this)?
 						$e_item = array(
-							UrlHelper::rewrite_relative($site_url, $e->link),
+							UrlHelper::rewrite_relative($site_url, $e->link, "", "", $e->type),
 							$e->type, $e->length, $e->title, $e->width, $e->height);
 
 						// Yet another episode of "mysql utf8_general_ci is gimped"
diff --git a/classes/urlhelper.php b/classes/urlhelper.php
index 9ac7781ef..22fe067d5 100644
--- a/classes/urlhelper.php
+++ b/classes/urlhelper.php
@@ -6,6 +6,10 @@ class UrlHelper {
 		"tel"
 	];
 
+	const EXTRA_SCHEMES_BY_CONTENT_TYPE = [
+		"application/x-bittorrent" => [ "magnet" ],
+	];
+
 	// TODO: class properties can be switched to PHP typing if/when the minimum PHP_VERSION is raised to 7.4.0+
 	/** @var string */
 	static $fetch_last_error;
@@ -52,10 +56,16 @@ class UrlHelper {
 	 * @param string $rel_url Possibly relative URL in the document
 	 * @param string $owner_element Owner element tag name (i.e. "a") (optional)
 	 * @param string $owner_attribute Owner attribute (i.e. "href") (optional)
+	 * @param string $content_type URL content type as specified by enclosures, etc.
 	 *
 	 * @return false|string Absolute URL or false on failure (either during URL parsing or validation)
 	 */
-	public static function rewrite_relative($base_url, $rel_url, string $owner_element = "", string $owner_attribute = "") {
+	public static function rewrite_relative($base_url,
+				$rel_url,
+				string $owner_element = "",
+				string $owner_attribute = "",
+				string $content_type = "") {
+
 		$rel_parts = parse_url($rel_url);
 
 		/**
@@ -80,6 +90,11 @@ class UrlHelper {
 				$owner_element == "a" &&
 				$owner_attribute == "href") {
 			return $rel_url;
+		// allow some extra schemes for links with feed-specified content type i.e. enclosures
+		} else if ($content_type &&
+				is_array(self::EXTRA_SCHEMES_BY_CONTENT_TYPE[$content_type]) &&
+				in_array($rel_parts["scheme"], self::EXTRA_SCHEMES_BY_CONTENT_TYPE[$content_type])) {
+			return $rel_url;
 		// allow limited subset of inline base64-encoded images for IMG elements
 		} else if (($rel_parts["scheme"] ?? "") == "data" &&
 				preg_match('%^image/(webp|gif|jpg|png|svg);base64,%', $rel_parts["path"]) &&