fix: block private/loopback/IMDS URLs in html-image-prefetch renderer to prevent SSRF

server/modules/rendering/html-image-prefetch/renderer.js

@@ -1,7 +1,22 @@
 const request = require('request-promise')
+const { URL } = require('url')
+
+const BLOCKED_HOSTS = /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|::1$|::ffff:)/
+
+function isSafeUrl (urlStr) {
+  let parsed
+  try { parsed = new URL(urlStr) } catch { return false }
+  if (!['http:', 'https:'].includes(parsed.protocol)) return false
+  if (parsed.hostname === 'localhost' || BLOCKED_HOSTS.test(parsed.hostname)) return false
+  return true
+}
 
 const prefetch = async (element) => {
   const url = element.attr(`src`)
+  if (!isSafeUrl(url)) {
+    WIKI.logger.warn(`Blocked unsafe prefetch URL: ${url}`)
+    return
+  }
   let response
   try {
     response = await request({