Security: Validate URLs to prevent SSRF and local resource access#20
Closed
fredluz wants to merge 1 commit intogarrytan:mainfrom
Closed
Security: Validate URLs to prevent SSRF and local resource access#20fredluz wants to merge 1 commit intogarrytan:mainfrom
fredluz wants to merge 1 commit intogarrytan:mainfrom
Conversation
Add url-validation.ts that blocks file:// URLs, private/internal IPs (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7), and non-HTTP schemes before any page.goto() call. Applied in all three navigation points: goto command, newTab(), and diff. Bypass with BROWSE_ALLOW_PRIVATE=1 for local development. Fixes garrytan#17 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
rafiulnakib
pushed a commit
to rafiulnakib/gstack
that referenced
this pull request
Mar 26, 2026
…arrytan#15-garrytan#18) limitations Visualizer: progressive disclosure with route-level expand/collapse (garrytan#19), interactive toolbar with search/filter/depth slider (garrytan#20), terminal ASCII output with ANSI colors (garrytan#21). Resolvers: staleness sync with auto-reconciliation (garrytan#15), atomic file locking with O_CREAT|O_EXCL (garrytan#16), 15-component spot-check with thorough mode (garrytan#17), fuzzy anti-pattern matching with Levenshtein + synonyms (garrytan#18). Product map: export mode (garrytan#11), shared map with feature merge (garrytan#12), tiered compression (garrytan#13), enhanced bootstrap fallback (garrytan#14).
nczempin
added a commit
to nczempin/gstack
that referenced
this pull request
Mar 30, 2026
Binary was tracked by upstream (garrytan/gstack) due to historical mistake. The file is in .gitignore but was committed before the rule took effect. This commit removes it from the index while keeping the local file. Closes garrytan#20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
mengtanx
pushed a commit
to mengtanx/gstack
that referenced
this pull request
Apr 6, 2026
refactor middleware for better session handling
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
browse/src/url-validation.tswith avalidateUrl()function that blocks dangerous URL schemes (file://,data:, etc.) and private/internal IP addresses (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7, localhost)page.goto()call in three locations:gotocommand,newTab(), anddiffcommandhttp:andhttps:schemes are allowed by defaultBROWSE_ALLOW_PRIVATE=1env var for legitimate local developmentFixes #17
Test plan
browse goto file:///etc/passwdis blocked with a clear errorbrowse goto http://169.254.169.254/latest/meta-data/is blockedbrowse goto http://127.0.0.1:3000is blockedbrowse goto http://10.0.0.1is blockedbrowse goto https://example.comstill worksBROWSE_ALLOW_PRIVATE=1 browse goto http://localhost:3000is allowedbrowse diff http://127.0.0.1 https://example.comis blockedbrowse newtab file:///etc/hostsis blocked🤖 Generated with Claude Code