lib/discover: Don't leak relay-tokens to discovery (#8762)

Use an allowlist to send only the `id` query param to the discovery server.
2023-03-04 12:16:57 +01:00
parent 8bbf2ba9ac
commit 4558eef446
2 changed files with 41 additions and 0 deletions
@@ -54,6 +54,15 @@ type announcement struct {
 	Addresses []string `json:"addresses"`
 }

+func (a announcement) MarshalJSON() ([]byte, error) {
+	type announcementCopy announcement
+
+	a.Addresses = sanitizeRelayAddresses(a.Addresses)
+
+	aCopy := announcementCopy(a)
+	return json.Marshal(aCopy)
+}
+
 type serverOptions struct {
 	insecure   bool   // don't check certificate
 	noAnnounce bool   // don't announce