#399

backend/app/services/preview/http_fetcher.rb

@@ -12,8 +12,12 @@ module Preview
 
     Response = Data.define(:body, :content_type, :url)
 
-    def self.fetch(raw_url, max_bytes: DEFAULT_MAX_BYTES, redirects: MAX_REDIRECTS)
+    def self.fetch(raw_url, max_bytes: DEFAULT_MAX_BYTES, redirects: MAX_REDIRECTS,
+                   allowed_hosts: nil)
       uri, addresses = UrlSafety.validate(raw_url)
+      if allowed_hosts && !allowed_hosts.include?(uri.host.downcase)
+        raise FetchFailed, '許可されてゐない redirect 先です．'
+      end
       response = request(uri, addresses.first, max_bytes)
 
       if response.is_a?(Net::HTTPRedirection)
@@ -50,7 +54,7 @@ module Preview
               raise FetchFailed, 'redirect 先が不正です．'
             end
 
-        return fetch(redirect_url, max_bytes:, redirects: redirects - 1)
+        return fetch(redirect_url, max_bytes:, redirects: redirects - 1, allowed_hosts:)
       end
 
       unless response.is_a?(Net::HTTPSuccess)