Add proper URI component encoding + hostname check

2026-10-14 00:29:34 +00:00 · 2025-07-25 16:55:21 -04:00
parent 52ef0e6b81
commit 0b7b32bdc3
3 changed files with 18 additions and 13 deletions
@@ -14,6 +14,11 @@ export const blockLocalAndPrivateIpAddresses = async (url: string) => {
  if (appCfg.isDevelopmentMode) return;

  const validUrl = new URL(url);
+
+  if (validUrl.username || validUrl.password) {
+    throw new BadRequestError({ message: "URLs with user credentials (e.g., user:pass@) are not allowed" });
+  }
+
  const inputHostIps: string[] = [];
  if (isIPv4(validUrl.hostname)) {
    inputHostIps.push(validUrl.hostname);