spb/search-box Public

1/**2 * Search-box.ai3 * Author: Simon-Pierre Boucher4 * Contact: contact@spboucher.ai5 * File: packages/firecrawl/src/url-guard.ts6 * Description: SSRF guard — rejects private/localhost/metadata URLs before any fetch.7 */89const BLOCKED_HOSTNAMES = new Set([10  "localhost",11  "127.0.0.1",12  "0.0.0.0",13  "::1",14  "169.254.169.254", // cloud metadata15  "metadata.google.internal"16]);1718const PRIVATE_IP_PATTERNS = [19  /^10\./,20  /^127\./,21  /^169\.254\./,22  /^172\.(1[6-9]|2\d|3[01])\./,23  /^192\.168\./,24  /^0\./,25  /^fc/i,26  /^fd/i,27  /^fe80/i28];2930/** Throws if the URL is not a safe public http(s) URL. Returns the normalized URL. */31export function assertSafeUrl(raw: string): string {32  let url: URL;33  try {34    url = new URL(raw);35  } catch {36    throw new Error(`invalid URL: ${raw}`);37  }38  if (url.protocol !== "http:" && url.protocol !== "https:") {39    throw new Error(`unsupported protocol: ${url.protocol}`);40  }41  const host = url.hostname.toLowerCase();42  if (BLOCKED_HOSTNAMES.has(host)) throw new Error(`blocked host: ${host}`);43  if (host.endsWith(".local") || host.endsWith(".internal")) {44    throw new Error(`blocked internal host: ${host}`);45  }46  if (PRIVATE_IP_PATTERNS.some((re) => re.test(host))) {47    throw new Error(`blocked private address: ${host}`);48  }49  return url.toString();50}51