From 56b9c2405b13b93e5090b6933efa429a74c56780 Mon Sep 17 00:00:00 2001 From: Ivan Paramonau Date: Fri, 11 Sep 2026 11:57:23 -0400 Subject: [PATCH] security: provide default config to protect from basic SSRF attacks --- config.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config.js b/config.js index c24787e3a..fa793e361 100644 --- a/config.js +++ b/config.js @@ -27,6 +27,12 @@ WHITELIST_WILDCARD: {}, + IGNORE_DOMAINS_RE: [ + /^https?:\/\/\d+\.\d+\.\d+\.\d+/i, // Includes localhost and local network, AWS metadata services, etc. + /^https?:\/\/localhost/i, + /^https?:\/\/[^\/]+:\d+\/?/, // Blocks port-scan via DNS pointing to 127.0.0.1 + ], + // Default cache engine to prevent warning. CACHE_ENGINE: 'node-cache', CACHE_TTL: 24 * 60 * 60,