diff --git a/src/wkd.js b/src/wkd.js index 6240a22..f942f70 100644 --- a/src/wkd.js +++ b/src/wkd.js @@ -15,6 +15,10 @@ // License along with this library; if not, write to the Free Software // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +// inspired by `is-html` +// +const basic = /\s?|(]*>|]*>|]+>)+/i; + /** * This class implements a client for the Web Key Directory (WKD) protocol * in order to lookup keys on designated servers. @@ -69,7 +73,16 @@ class WKD { } } - return new Uint8Array(await response.arrayBuffer()); + const uint8Array = new Uint8Array(await response.arrayBuffer()) + + // inspired by `is-html` + // + const str = new TextDecoder().decode(uint8Array); + if (str && basic.test(str.trim().slice(0, 1000))) { + throw new Error('Invalid WKD lookup result (HTML content detected)'); + } + + return uint8Array; } } diff --git a/test/wkd.js b/test/wkd.js index 11dc729..c9fcd7d 100644 --- a/test/wkd.js +++ b/test/wkd.js @@ -29,6 +29,16 @@ describe('WKD unit tests', function() { expect(error.message).to.equal('Direct WKD lookup failed: Not Found') }); }); + + it('by email address should not work on invalid website', function() { + return wkd.lookup({ + email: 'beep@boop.com' + }).then(function() { + throw new Error('Lookup should throw an error'); + }).catch(function(error) { + expect(error.message).to.equal('Invalid WKD lookup result (text/html Content-Type header)'); + }); + }); }); });