Refactor 'uploadFromUrl' to base storage implementation

Add safety around using fetch implementation

server/utils/avatars.ts

@@ -1,5 +1,5 @@
 import crypto from "crypto";
-import fetch from "fetch-with-proxy";
+import fetch from "./fetch";
 
 export async function generateAvatarUrl({
   id,

server/utils/fetch.ts

@@ -0,0 +1,28 @@
+/* eslint-disable no-restricted-imports */
+import fetchWithProxy from "fetch-with-proxy";
+import nodeFetch, { RequestInit, Response } from "node-fetch";
+import { useAgent } from "request-filtering-agent";
+import env from "@server/env";
+
+/**
+ * Wrapper around fetch that uses the request-filtering-agent in cloud hosted
+ * environments to filter malicious requests, and the fetch-with-proxy library
+ * in self-hosted environments to allow for request from behind a proxy.
+ *
+ * @param url The url to fetch
+ * @param init The fetch init object
+ * @returns The response
+ */
+export default function fetch(
+  url: string,
+  init?: RequestInit
+): Promise<Response> {
+  // In self-hosted, webhooks support proxying and are also allowed to connect
+  // to internal services, so use fetchWithProxy without the filtering agent.
+  const fetch = env.isCloudHosted() ? nodeFetch : fetchWithProxy;
+
+  return fetch(url, {
+    ...init,
+    agent: env.isCloudHosted() ? useAgent(url) : undefined,
+  });
+}

server/utils/oauth.ts

@@ -1,6 +1,6 @@
-import fetch from "fetch-with-proxy";
 import Logger from "@server/logging/Logger";
 import { AuthenticationError, InvalidRequestError } from "../errors";
+import fetch from "./fetch";
 
 export default abstract class OAuthClient {
   private clientId: string;

server/utils/passport.ts

@@ -1,6 +1,5 @@
 import crypto from "crypto";
 import { addMinutes, subMinutes } from "date-fns";
-import fetch from "fetch-with-proxy";
 import type { Context } from "koa";
 import {
   StateStoreStoreCallback,
@@ -11,6 +10,7 @@ import { getCookieDomain, parseDomain } from "@shared/utils/domains";
 import env from "@server/env";
 import { Team } from "@server/models";
 import { OAuthStateMismatchError } from "../errors";
+import fetch from "./fetch";
 
 export class StateStore {
   key = "state";

server/utils/updates.ts

@@ -1,5 +1,4 @@
 import crypto from "crypto";
-import fetch from "fetch-with-proxy";
 import env from "@server/env";
 import Collection from "@server/models/Collection";
 import Document from "@server/models/Document";
@@ -7,6 +6,7 @@ import Team from "@server/models/Team";
 import User from "@server/models/User";
 import Redis from "@server/storage/redis";
 import packageInfo from "../../package.json";
+import fetch from "./fetch";
 
 const UPDATES_URL = "https://updates.getoutline.com";
 const UPDATES_KEY = "UPDATES_KEY";