Ensure that cookies are sent only to the correct domains.cookies

We want to avoid that authentication data is sent when fetching images from external sources, for instance.

1 files changed, 10 insertions, 1 deletions

diff --git a/internal/feed/feed.go b/internal/feed/feed.go
index f31de65..f403036 100644
--- a/internal/feed/feed.go
+++ b/internal/feed/feed.go
@@ -21,6 +21,7 @@ type Feed struct {
 	items  []Item
 	Global config.GlobalOptions
 	extID  FeedID
+	jar    http.CookieJar
 }
 
 type FeedID interface {
@@ -35,10 +36,18 @@ type Descriptor struct {
 }
 
 func (feed *Feed) Context() http.Context {
+	if feed.Url != "" && len(feed.Cookies) > 0 && feed.jar == nil {
+		var err error
+		feed.jar, err = http.JarOfCookies(feed.Cookies, feed.Url)
+		if err != nil {
+			log.Errorf("Error while initialising cookies for feed '%s': %w", feed.Name, err)
+		}
+	}
+
 	return http.Context{
 		Timeout:    feed.Global.Timeout,
 		DisableTLS: feed.NoTLS,
-		Cookies:    feed.Cookies,
+		Jar:        feed.jar,
 	}
 }