Features that take URLs
- Link preview or unfurl features.
- Import from URL for images or files.
- User-configured webhooks.
- AI features that fetch a page the user names.
Controls to apply
- Accept only http and https, and only ports you expect.
- Resolve the hostname and refuse loopback, private and link-local ranges, then connect to the resolved address to avoid DNS rebinding.
- Limit redirects and re-check each hop.
- Set short timeouts and response size caps.
- Run fetchers with no access to internal networks or credentials where possible.
Cloud metadata
Cloud providers expose credentials on a link-local address. Use the provider's hardened metadata option and keep instance roles narrow.
Frequently asked questions
Is blocking the string localhost enough?
No. Attackers use alternative encodings and DNS names that resolve to internal addresses. Check the resolved address.