Initial commit
This commit is contained in:
commit
71a0e9729a
SSH key fingerprint:
SHA256:swjoHhREbZPbWe+gyJNi24d4NAxJSyUIm3fpZj4z3wc
31
README.md
Normal file
31
README.md
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# discord webhook proxy server
|
||||
|
||||
a shitty web server that lets you post messages into it and have them forwarded to a discord webhook. designed to hook up easily to a simple `<form>` on your website that randos can use to cyberbully you.
|
||||
|
||||
## environment variables
|
||||
|
||||
- `WEBHOOK_URL`: required. the discord webhook url you want your messages to be sent to. this can also be passed to the program as a command-line argument instead of an environment variable, if you want.
|
||||
- `PORT`: default `80`. the port to listen on.
|
||||
- `TRUST_X_FORWARDED_HOST`, `TRUST_X_FORWARDED_PROTO`, `TRUST_X_FORWARDED_FOR`, `TRUST_X_REAL_IP`: these correspond to headers commonly set by reverse proxies to convey information about the original request as they proxy it to the app. if you deploy this app behind a reverse proxy, set the variables that correspond to the headers your reverse proxy sets. (any non-empty value will be considered "true.") trusting a header that can be controlled directly by a requester will allow identity spoofing, so don't use these variables to trust headers that aren't explicitly set by your proxy (unless you're into that sort of thing).
|
||||
|
||||
## api
|
||||
|
||||
### `POST /send`
|
||||
|
||||
accepts `Content-Type: application/x-www-form-urlencoded` (the default for HTML forms) or `application/json`. fields:
|
||||
|
||||
- `content`: message content. max length 4096
|
||||
- `title`: optional. message title. max length 256
|
||||
- `color`: optional. sets the color of the embed displayed. a 6-digit case-insensitive hex color prefixed with a leading `#`; no other color formats are accepted.
|
||||
|
||||
by default the server returns HTML responses so it's at lease somewhat friendly for use in a bare HTML `<form>`. if you want to be fancy you can submit the form with JS and set your request's `Accept` header to `application/json` to get slightly more structured responses (204 with no content on success, 400 with an `{"error": "the message"}` object on failure
|
||||
|
||||
## example form
|
||||
|
||||
```html
|
||||
<form action="https://your.thing/send" method="post">
|
||||
<input type="text" name="title" id="title" />
|
||||
<textarea name="content"></textarea>
|
||||
<button type="submit">Send</button>
|
||||
</form>
|
||||
```
|
||||
39
example.html
Normal file
39
example.html
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>bweep bwoop</title>
|
||||
</head>
|
||||
<body>
|
||||
<!-- this will work fine with noscript -->
|
||||
<form action="http://localhost:4567/send" method="post">
|
||||
<p><input type="text" name="title" /></p>
|
||||
<p><textarea name="content"></textarea></p>
|
||||
<p><input type="color" name="color" /></p>
|
||||
<p><button type="submit">Send</button></p>
|
||||
</form>
|
||||
<!-- look at that progressive enhancement -->
|
||||
<script>
|
||||
document.querySelector('form').addEventListener('submit', (e) => {
|
||||
e.preventDefault();
|
||||
fetch(`http://localhost:4567/send`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
'Accept': 'application/json',
|
||||
},
|
||||
body: JSON.stringify(Object.fromEntries(new FormData(e.target).entries())),
|
||||
}).then(response => {
|
||||
if (!response.ok) {
|
||||
alert(`failed to send: ${error}`);
|
||||
}
|
||||
alert('sent!');
|
||||
e.target.reset();
|
||||
}).catch(error => {
|
||||
alert('either your network died or you have a CORS issue, check the network log');
|
||||
});
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
112
index.mjs
Normal file
112
index.mjs
Normal file
|
|
@ -0,0 +1,112 @@
|
|||
import assert from 'node:assert';
|
||||
import {createServer} from 'node:http';
|
||||
import {parse as parseQueryString} from 'node:querystring';
|
||||
|
||||
const webhook = process.argv[2] || process.env.WEBHOOK_URL;
|
||||
assert(webhook, 'give me a webhook url please');
|
||||
|
||||
const port = process.env.PORT || 80;
|
||||
|
||||
createServer(async (request, response) => {
|
||||
const host = (process.env.TRUST_X_FORWARDED_HOST && request.headers['x-forwarded-host']) || `localhost:${port}`;
|
||||
const proto = (process.env.TRUST_X_FORWARDED_PROTO && request.headers['x-forwarded-proto']) || 'http';
|
||||
const url = new URL(`${proto}://${host}${request.url}`);
|
||||
|
||||
/** @type {import('node:http').OutgoingHttpHeaders} */
|
||||
const cors = {
|
||||
'Vary': 'Origin',
|
||||
'Access-Control-Allow-Origin': request.headers['origin'] || '*',
|
||||
}
|
||||
|
||||
try {
|
||||
assert(url.pathname === '/send', 'you seem lost');
|
||||
if (request.method === 'OPTIONS') {
|
||||
response.writeHead(request.headers['Access-Control-Request-Method'] === 'POST' ? 204 : 400, {
|
||||
...cors,
|
||||
'Access-Control-Allow-Methods': 'POST',
|
||||
}).end();
|
||||
}
|
||||
assert(request.method === 'POST', 'we dont do that here');
|
||||
assert(
|
||||
(
|
||||
request.headers['content-type']?.startsWith('application/x-www-form-urlencoded')
|
||||
|| request.headers['content-type']?.startsWith('application/json')
|
||||
),
|
||||
'what the fuck am i looking at',
|
||||
);
|
||||
|
||||
const body = await new Promise((resolve, reject) => {
|
||||
let chunks = [];
|
||||
request.on('data', chunk => chunks.push(chunk));
|
||||
request.on('end', () => {
|
||||
resolve(Buffer.concat(chunks).toString('utf-8'));
|
||||
});
|
||||
request.on('error', () => {
|
||||
request.removeAllListeners('data');
|
||||
request.removeAllListeners('end');
|
||||
reject(new Error('hello????'));
|
||||
});
|
||||
});
|
||||
|
||||
let {title, content, color} =
|
||||
request.headers['content-type'].includes('application/json')
|
||||
? JSON.parse(body)
|
||||
: parseQueryString(body);
|
||||
|
||||
assert(
|
||||
(
|
||||
(typeof content === 'string' && content.length > 0)
|
||||
&& (title == null || typeof title === 'string')
|
||||
&& (color == null || typeof color === 'string')
|
||||
),
|
||||
"jesse what the fuck are you talking about",
|
||||
);
|
||||
assert((title == null || title.length <= 256) && (content.length <= 4096), "quit yapping");
|
||||
|
||||
if (color === '#000000') {
|
||||
color = undefined;
|
||||
} else if (color != null) {
|
||||
assert(color[0] === '#', 'what are you trying to do here');
|
||||
color = parseInt(color.slice(1), 16);
|
||||
assert(!isNaN(color) && color > 0 && color <= 0xFFFFFF, 'ok now youre just making shit up');
|
||||
}
|
||||
|
||||
if (request.headers['accept'].startsWith('application/json')) {
|
||||
response.writeHead(204, {'Content-Type': 'application/json', ...cors}).end();
|
||||
} else {
|
||||
response.writeHead(200, {'Content-Type': 'text/html'});
|
||||
response.end(`<html><body><h1>submitted!</h1><script>document.write('<p><button onclick="window.history.back()">« go back</button></p>')</script></body></html>`);
|
||||
}
|
||||
|
||||
const ip = (
|
||||
(process.env.TRUST_X_FORWARDED_FOR && request.headers['x-forwarded-for']?.split(',')[0].trim())
|
||||
|| (process.env.TRUST_X_REAL_IP && request.headers['x-real-ip'])
|
||||
|| request.socket.remoteAddress
|
||||
|| 'the void'
|
||||
);
|
||||
|
||||
fetch(process.env.WEBHOOK_URL, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
},
|
||||
body: JSON.stringify({
|
||||
embeds: [{
|
||||
title,
|
||||
description: content,
|
||||
color,
|
||||
footer: {text: `${ip} • ${url}`},
|
||||
timestamp: new Date().toISOString(),
|
||||
}],
|
||||
}),
|
||||
});
|
||||
} catch (error) {
|
||||
if (request.headers['accept']?.startsWith('application/json')) {
|
||||
response.writeHead(400, {'Content-Type': 'application/json', ...cors});
|
||||
response.end(JSON.stringify({error: error.message || 'you done fucked up'}));
|
||||
} else {
|
||||
response.writeHead(400, {'Content-Type': 'text/html'});
|
||||
response.end(`<html><body><h1>you done fucked up</h1><pre>${error.message}</pre></body></html>`);
|
||||
}
|
||||
}
|
||||
}).listen(port);
|
||||
Loading…
Reference in a new issue