feat: guard against non-HTML content types

1 files changed, 16 insertions, 2 deletions

diff --git a/fetch.go b/fetch.go
index fc08080..3bcd480 100644
--- a/fetch.go
+++ b/fetch.go
@@ -5,6 +5,8 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"strings"
+	"time"
 )
 
 // fetch makes a GET request to refURL, returning the HTML contents of
@@ -16,8 +18,10 @@ import (
 func fetch(refURL url.URL) ([]byte, error) {
 	rawURL := refURL.String()
 
-	// For now we leave the client unconfigured.
-	client := http.Client{}
+	// FIXME: make the timeout configurable.
+	client := http.Client{
+		Timeout: 2 * time.Second,
+	}
 
 	req, err := http.NewRequest(http.MethodGet, rawURL, nil)
 	if err != nil {
@@ -36,6 +40,10 @@ func fetch(refURL url.URL) ([]byte, error) {
 		return nil, fmt.Errorf("status for %s for %s: %s", http.MethodGet, rawURL, resp.Status)
 	}
 
+	if contentType := resp.Header.Get("content-type"); !goodContentType(contentType) {
+		return nil, fmt.Errorf("non-html content-type: %s", contentType)
+	}
+
 	htmlBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, fmt.Errorf("can't read reponse body into byte buffer")
@@ -43,3 +51,9 @@ func fetch(refURL url.URL) ([]byte, error) {
 
 	return htmlBytes, nil
 }
+
+func goodContentType(contentType string) bool {
+	what := strings.TrimSpace(strings.SplitN(contentType, ";", 2)[0])
+
+	return what == "text/html"
+}