Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/openstatusHQ/openstatus. 🫖 Status page with uptime monitoring & API monitoring as code 🫖 openstatus.dev
bun drizzle-orm monitoring monitoring-as-code nextjs observability on-call open-source shadcn-ui status-page statuspage synthetic-monitoring tinybird turso uptime uptime-checker uptime-monitor
Something went wrong. Try again.
1.3 kB · 47 lines
TypeScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748import { assertSafeUrlSync } from "@openstatus/utils";
type UrlGuardResult = | { ok: true } | { ok: false; error: string; status: number };
export function validateCdnUrl(url: string): UrlGuardResult { try { // protocol check + private/loopback/metadata-host block assertSafeUrlSync(url); } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "Invalid URL", status: 400, }; }
const urlObject = new URL(url); const hostname = urlObject.hostname.toLowerCase(); if ( (hostname === "openstatus.dev" || hostname.endsWith(".openstatus.dev")) && urlObject.pathname.startsWith("/play/cdn-checker/api") ) { return { ok: false, error: "Self-requests are not allowed", status: 400 }; }
const blacklistPatterns = (process.env.BLACKLIST_URL ?? "") .split(",") .map((p) => p.trim()) .filter(Boolean); for (const pattern of blacklistPatterns) { let matches = false; try { matches = new RegExp(pattern).test(url); } catch (error) { // skip the bad pattern so it can't silently disable the whole guard console.error("Invalid blacklist pattern", pattern, error); continue; } if (matches) { return { ok: false, error: "This URL is not allowed", status: 403 }; } }
return { ok: true };}