Potential fix for code scanning alert no. 2: Server-side request forgery

[SSMG4]

Potential fix for https://github.com/Hexadecinull/WebSquared/security/code-scanning/2

To fix this without changing intended proxy functionality, validate and normalize the decoded target URL before the first fetch call, and reject any non-HTTP(S) or private/internal destinations. This preserves the proxy behavior for public web targets while blocking SSRF to local network resources.

Best concrete change in src/server/proxy.ts:

• Right after parsing targetUrl into parsedTarget (and after query re-attachment), enforce:
  1. Protocol allowlist: only https: (or normalize http: to https: if that is existing behavior).
  2. Private/internal hostname rejection using existing isPrivateHostname(...).
• Recompute targetUrl = parsedTarget.href after normalization so downstream code (buildRequestHeaders, currentUrl) uses the sanitized URL.
• Keep current redirect protections as-is.

No changes are required in src/shared/url.ts for this finding, because encoding/decoding is not validation.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5103a4e6-cf67-4692-b949-a9b356e63fa3

📥 Commits

Reviewing files that changed from the base of the PR and between 20173fd and 7e28e55.

📒 Files selected for processing (1)

• src/server/proxy.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}