From 1b0b96bdea8080408ebdb3194aeb3d3871275636 Mon Sep 17 00:00:00 2001
From: Shakeel Bhat <shakeelurrehman.bhat@crowdstrike.com>
Date: Mon, 27 Jul 2026 23:00:27 +0530
Subject: [PATCH] fix: block private/loopback/IMDS URLs in html-image-prefetch
 renderer to prevent SSRF

---
 .../rendering/html-image-prefetch/renderer.js     | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/server/modules/rendering/html-image-prefetch/renderer.js b/server/modules/rendering/html-image-prefetch/renderer.js
index 07b8afa7..fc20e454 100644
--- a/server/modules/rendering/html-image-prefetch/renderer.js
+++ b/server/modules/rendering/html-image-prefetch/renderer.js
@@ -1,7 +1,22 @@
 const request = require('request-promise')
+const { URL } = require('url')
+
+const BLOCKED_HOSTS = /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|::1$|::ffff:)/
+
+function isSafeUrl (urlStr) {
+  let parsed
+  try { parsed = new URL(urlStr) } catch { return false }
+  if (!['http:', 'https:'].includes(parsed.protocol)) return false
+  if (parsed.hostname === 'localhost' || BLOCKED_HOSTS.test(parsed.hostname)) return false
+  return true
+}
 
 const prefetch = async (element) => {
   const url = element.attr(`src`)
+  if (!isSafeUrl(url)) {
+    WIKI.logger.warn(`Blocked unsafe prefetch URL: ${url}`)
+    return
+  }
   let response
   try {
     response = await request({