check input URL scheme before continuing

2025-05-28 13:31:40 -04:00
parent f4107b1c2b
commit f601cff5c5
1 changed files with 7 additions and 0 deletions
@@ -139,6 +139,13 @@ export class UrlPreviewService {
 			return;
 		}

+		// Enforce HTTP(S) for input URLs
+		const urlScheme = this.utilityService.getUrlScheme(url);
+		if (urlScheme !== 'http:' && urlScheme !== 'https:') {
+			reply.code(400);
+			return;
+		}
+
 		const lang = request.query.lang;
 		if (Array.isArray(lang)) {
 			reply.code(400);