feat: Validate url

src/entities/Event/routes/createEvent.ts

@@ -22,7 +22,11 @@ import {
   EventAttributes,
   MAX_EVENT_DURATION,
 } from "../types"
-import { calculateRecurrentProperties, eventTargetUrl } from "../utils"
+import {
+  calculateRecurrentProperties,
+  eventTargetUrl,
+  validateImageUrl,
+} from "../utils"
 
 const validateNewEvent = createValidator<EventAttributes>(
   newEventSchema as AjvObjectSchema
@@ -61,6 +65,10 @@ export async function createEvent(req: WithAuthProfile<WithAuth>) {
 
   validateNewEvent(data)
 
+  if (data.image) {
+    await validateImageUrl(data.image)
+  }
+
   const x = data.x
   const y = data.y
   if (!isInsideWorldLimits(x, y)) {

src/entities/Event/routes/updateEvent.ts

@@ -39,7 +39,11 @@ import {
   editEventAttributes,
   editOwnEventAttributes,
 } from "../types"
-import { calculateRecurrentProperties, eventTargetUrl } from "../utils"
+import {
+  calculateRecurrentProperties,
+  eventTargetUrl,
+  validateImageUrl,
+} from "../utils"
 
 import { DECENTRALAND_URL } from "./index"
 
@@ -111,6 +115,10 @@ export async function updateEvent(req: WithAuthProfile<WithAuth>) {
     recurrent_until: Time.date(updatedAttributes.recurrent_until)?.toJSON(),
   })
 
+  if (updatedAttributes.image) {
+    await validateImageUrl(updatedAttributes.image)
+  }
+
   // make schedules unique
   if (updatedAttributes.schedules) {
     updatedAttributes.schedules = Array.from(

src/entities/Event/utils.ts

@@ -1,3 +1,5 @@
+import logger from "decentraland-gatsby/dist/entities/Development/logger"
+import RequestError from "decentraland-gatsby/dist/entities/Route/error"
 import { CatalystAbout } from "decentraland-gatsby/dist/utils/api/Catalyst.types"
 import Time from "decentraland-gatsby/dist/utils/date/Time"
 import env from "decentraland-gatsby/dist/utils/env"
@@ -16,6 +18,7 @@ import {
   WeekdayMask,
   Weekdays,
 } from "./types"
+import { POSTER_FILE_SIZE, POSTER_FILE_TYPES } from "../Poster/types"
 import { ScheduleAttributes } from "../Schedule/types"
 
 const DECENTRALAND_URL = env(
@@ -31,6 +34,8 @@ const PROFILE_SITE_URL = env(
   "https://profile.decentraland.org"
 )
 
+const BUCKET_URL = env("AWS_BUCKET_URL")
+
 export function profileSiteUrl(address: string) {
   const target = new URL(PROFILE_SITE_URL)
   target.pathname = `/accounts/${address}`
@@ -449,3 +454,19 @@ export function isPastEvent(event: EventAttributes) {
   const finish_at = Time.date(event.finish_at)
   return finish_at.getTime() < now
 }
+
+export async function validateImageUrl(imageUrl: string) {
+  const url = new URL(imageUrl)
+  const whitelistedDomains = [BUCKET_URL].filter(
+    (domain): domain is string => !!domain
+  )
+
+  if (!whitelistedDomains.some((domain) => domain.endsWith(url.host))) {
+    throw new RequestError(
+      `Invalid image url ${imageUrl}, please upload the image through the upload poster endpoint (POST /poster)`,
+      RequestError.BadRequest
+    )
+  }
+
+  return imageUrl
+}