src/Metadata/Controllers/MetadataController.cs

@@ -16,6 +16,7 @@ using Microsoft.AspNetCore.Mvc;
 using Newtonsoft.Json.Linq;
 using System;
 using System.Collections.Generic;
+using System.Net;
 using System.Threading.Tasks;
 using System.Web;
 using VDS.RDF;
@@ -71,7 +72,12 @@ namespace Coscine.Api.Metadata.Controllers
         [HttpGet("[controller]/profiles/{profile}")]
         public IActionResult GetProfile(string profile)
         {
-            string profileUrl = profile.StartsWith("http") ? HttpUtility.UrlDecode(profile) : $"{ApplicationProfileUrl}{profile}/";
+            var profileUrl = profile.StartsWith("http") ? HttpUtility.UrlDecode(profile) : $"{ApplicationProfileUrl}{profile}/";
+
+            if (!profileUrl.StartsWith(ApplicationProfileUrl))
+            {
+                return StatusCode((int)HttpStatusCode.Forbidden, $"Profile has to start with {ApplicationProfileUrl}!");
+            }
 
             var graph = _rdfStoreConnector.GetGraph(profileUrl);
 
@@ -100,10 +106,15 @@ namespace Coscine.Api.Metadata.Controllers
 
             if (user == null || !_resourceModel.HasAccess(user, resource, UserRoles.Owner, UserRoles.Member))
             {
-                return Forbid("User is no project member!");
+                return StatusCode((int)HttpStatusCode.Forbidden, "User is no project member!");
             }
 
-            string profileUrl = profile.StartsWith("http") ? HttpUtility.UrlDecode(profile) : $"{ApplicationProfileUrl}{profile}/";
+            var profileUrl = profile.StartsWith("http") ? HttpUtility.UrlDecode(profile) : $"{ApplicationProfileUrl}{profile}/";
+
+            if (!profileUrl.StartsWith(ApplicationProfileUrl))
+            {
+                return StatusCode((int)HttpStatusCode.Forbidden, $"Profile has to start with {ApplicationProfileUrl}!");
+            }
 
             var graph = _rdfStoreConnector.GetGraph(profileUrl);
             var fixedValuesGraph = new Graph();

src/Metadata/Metadata.csproj

@@ -5,7 +5,7 @@
 		<AssemblyName>Coscine.Api.Metadata</AssemblyName>
 		<GenerateDocumentationFile>true</GenerateDocumentationFile>
 		<TargetFramework>net5.0</TargetFramework>
-		<Version>2.2.0</Version>
+		<Version>2.2.1</Version>
 	</PropertyGroup>
 	<PropertyGroup>
 		<Authors>RWTH Aachen University</Authors>