Potential fix for code scanning alert no. 2: Server-side request forgery

[SSMG4]

Potential fix for https://github.com/Hexadecinull/WebSquared/security/code-scanning/2

To fix SSRF without changing core proxy mechanics, enforce a server-controlled hostname allowlist before any outbound fetch and on every redirect hop.

Best implementation in src/server/proxy.ts:

1. Add a constant allowlist sourced from env (e.g., PROXY_ALLOWED_HOSTS) and normalized to lowercase.
2. Add a helper isAllowedTargetHostname(hostname: string): boolean.
3. After parsing/normalizing parsedTarget and before using targetUrl, reject requests whose hostname is not allowlisted (403).
4. In redirect handling, apply the same allowlist check to next.hostname before updating currentUrl.

This preserves existing behavior for approved hosts, keeps current private-address protections, and closes the SSRF class by removing arbitrary host selection.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0b8b6eae-c85e-4288-9577-39e0ae06bd48

📥 Commits

Reviewing files that changed from the base of the PR and between 61315e6 and 4cc1185.

📒 Files selected for processing (1)

• src/server/proxy.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}