From 597d4de8dcdc7d0f9d906a0e99be3d72ed43b1cb Mon Sep 17 00:00:00 2001 From: demo Date: Fri, 12 Jun 2026 12:32:06 -0400 Subject: feat: guard against non-HTML content types --- fetch.go | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fetch.go b/fetch.go index fc08080..3bcd480 100644 --- a/fetch.go +++ b/fetch.go @@ -5,6 +5,8 @@ import ( "io" "net/http" "net/url" + "strings" + "time" ) // fetch makes a GET request to refURL, returning the HTML contents of @@ -16,8 +18,10 @@ import ( func fetch(refURL url.URL) ([]byte, error) { rawURL := refURL.String() - // For now we leave the client unconfigured. - client := http.Client{} + // FIXME: make the timeout configurable. + client := http.Client{ + Timeout: 2 * time.Second, + } req, err := http.NewRequest(http.MethodGet, rawURL, nil) if err != nil { @@ -36,6 +40,10 @@ func fetch(refURL url.URL) ([]byte, error) { return nil, fmt.Errorf("status for %s for %s: %s", http.MethodGet, rawURL, resp.Status) } + if contentType := resp.Header.Get("content-type"); !goodContentType(contentType) { + return nil, fmt.Errorf("non-html content-type: %s", contentType) + } + htmlBytes, err := io.ReadAll(resp.Body) if err != nil { return nil, fmt.Errorf("can't read reponse body into byte buffer") @@ -43,3 +51,9 @@ func fetch(refURL url.URL) ([]byte, error) { return htmlBytes, nil } + +func goodContentType(contentType string) bool { + what := strings.TrimSpace(strings.SplitN(contentType, ";", 2)[0]) + + return what == "text/html" +} -- cgit v1.2.3