feat: Add Parse.File.url validation with config fileUpload.allowedFileUrlDomains against SSRF attacks (#10044)

This commit is contained in:
Manuel
2026-02-07 17:03:39 +00:00
committed by GitHub
parent 9e07ca6d3b
commit 4c9c9489f0
16 changed files with 619 additions and 2 deletions

View File

@@ -532,7 +532,7 @@ class ParseServer {
let url;
try {
url = new URL(string);
} catch (_) {
} catch {
return false;
}
return url.protocol === 'http:' || url.protocol === 'https:';