domains: validate well known

2026-02-25 05:55:14 +01:00
parent c20fbe8635
commit f4ff63485a
2 changed files with 11 additions and 2 deletions
@@ -116,6 +116,15 @@ function validateTlsConfig(tlsConfig, dnsProvider) {
 function validateWellKnown(wellKnown) {
    assert.strictEqual(typeof wellKnown, 'object');

+    if (wellKnown === null) return null;
+
+    for (const key of Object.keys(wellKnown)) {
+        if (typeof wellKnown[key] !== 'string') return new BoxError(BoxError.BAD_FIELD, `well-known value for ${key} must be a string`);
+    }
+
+    if (wellKnown.carddav && wellKnown.carddav.includes('://')) return new BoxError(BoxError.BAD_FIELD, 'carddav must be a domain, not a URL');
+    if (wellKnown.caldav && wellKnown.caldav.includes('://')) return new BoxError(BoxError.BAD_FIELD, 'caldav must be a domain, not a URL');
+
    return null;
 }