update PLANS.md with ssrf and re-enrich sections

2026-07-15 11:38:09 +04:00
parent a7fce17d5b
commit 9eb25311c8
1 changed files with 14 additions and 0 deletions
@@ -18,3 +18,17 @@ fix: single query with `WHERE t.album_id = ANY($1::uuid[])` — already batched
 ### verification
 `comfortGenerator` and `deepDiveGenerator` are tested in `generators.test.ts`
 ## 2. SSRF guard (images.routes.ts)
 current: only checks `url.startsWith('http://') || url.startsWith('https://')` — trivial bypass
 fix: add domain allowlist of known image hosts, validate after redirect
 allowed domains:
 - coverartarchive.org + *.coverartarchive.org
 - lastfm.freetls.fastly.net
 - i.scdn.co (spotify)
 - images.genius.com
 - *.musicbrainz.org
 - commons.wikimedia.org
 - e.snmc.io