Skip to content

Commit 081f8fd

Browse files
committed
chore: add try/catch loop
we do this so that if there's a drift in validation we can still return a result
1 parent df9a80c commit 081f8fd

File tree

1 file changed

+11
-3
lines changed

1 file changed

+11
-3
lines changed

src/shared/util/validation.ts

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,17 @@ export function isValidUrl(url: string, useWhitelist = false): boolean {
4747
if (useWhitelist && isWhitelisted(url)) return true
4848
if (!validator.isURL(url, URL_OPTS)) return false
4949

50-
// NOTE: check whether it's an IP
51-
const host = new URL(url).hostname
52-
return !validator.isIP(host)
50+
// NOTE: Reject URLs with IP addresses to prevent the use of internal or private IPs
51+
// as long URLs. This is a security measure to mitigate risks such as
52+
// Server-Side Request Forgery (SSRF) and unauthorized access to internal resources.
53+
try {
54+
// NOTE: try/catch to avoid drifts in validation
55+
// between validator library and `URL` constructor
56+
const host = new URL(url).hostname
57+
return !validator.isIP(host)
58+
} catch {
59+
return false
60+
}
5361
}
5462

5563
// Tests if a short link consists of alphanumeric and hyphen characters.

0 commit comments

Comments
 (0)