Stop SSRF in a link-preview fetcher
Not solvedThe server fetches any URL a user pastes. Its allow-list is a substring check. Make it impossible to reach internal hosts.
- Level
- Practitioner
- Estimated time
- ~25 min
- Points
- 0/80 pts
- Questions
- 0/0 answered
- OWASP
- A01:2025
- CWE
- CWE-918
preview.js
Test results
Run the tests to check your code. It runs on the server in an isolated sandbox with no network access.