Check local urls for cloud instances on windmill custom domain input

frontend/src/pages/secret-manager/integrations/WindmillAuthorizePage/WindmillAuthorizePage.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from "@tanstack/react-router";
 
 import { Button, Card, CardTitle, FormControl, Input } from "@app/components/v2";
 import { useWorkspace } from "@app/context";
+import { isInfisicalCloud } from "@app/helpers/platform";
 import { useSaveIntegrationAccessToken } from "@app/hooks/api";
 
 export const WindmillAuthorizePage = () => {
@@ -15,6 +16,35 @@ export const WindmillAuthorizePage = () => {
   const [apiUrlErrorText, setApiUrlErrorText] = useState("");
   const [isLoading, setIsLoading] = useState(false);
 
+  const isLocalOrPrivateIpAddress = (url: string): boolean => {
+    try {
+      const validUrl = new URL(url);
+      // Check for localhost
+      if (validUrl.hostname === "localhost" || validUrl.hostname === "127.0.0.1") {
+        return true;
+      }
+
+      // Check for 10.x.x.x
+      if (validUrl.hostname.match(/^10\.\d+\.\d+\.\d+/)) {
+        return true;
+      }
+
+      // Check for host.docker.internal
+      if (validUrl.hostname === "host.docker.internal") {
+        return true;
+      }
+
+      // Check for 192.168.x.x
+      if (validUrl.hostname.match(/^192\.168\.\d+\.\d+/)) {
+        return true;
+      }
+      return false;
+    } catch (err) {
+      console.error(err);
+      return true;
+    }
+  };
+
   const handleButtonClick = async () => {
     try {
       setApiKeyErrorText("");
@@ -24,9 +54,15 @@ export const WindmillAuthorizePage = () => {
         return;
       }
 
-      if (apiUrl && !apiUrl.startsWith("http://") && !apiUrl.startsWith("https://")) {
+      if (apiUrl) {
-        setApiUrlErrorText("API URL must start with http:// or https://");
+        if (!apiUrl.startsWith("http://") && !apiUrl.startsWith("https://")) {
-        return;
+          setApiUrlErrorText("API URL must start with http:// or https://");
+          return;
+        }
+        if (isInfisicalCloud() && isLocalOrPrivateIpAddress(apiUrl)) {
+          setApiUrlErrorText("Local IPs not allowed as URL");
+          return;
+        }
       }
 
       setIsLoading(true);