FastGPT/packages/service/common/security/fileUrlValidator.ts

const systemWhiteList = (() => {
  const list: string[] = [];
  if (process.env.STORAGE_S3_ENDPOINT) {
    list.push(process.env.STORAGE_S3_ENDPOINT);
  }
  if (process.env.STORAGE_EXTERNAL_ENDPOINT) {
    try {
      const urlData = new URL(process.env.STORAGE_EXTERNAL_ENDPOINT);
      list.push(urlData.hostname);
    } catch (error) {}
  }
  if (process.env.FE_DOMAIN) {
    try {
      const urlData = new URL(process.env.FE_DOMAIN);
      list.push(urlData.hostname);
    } catch (error) {}
  }
  if (process.env.PRO_URL) {
    try {
      const urlData = new URL(process.env.PRO_URL);
      list.push(urlData.hostname);
    } catch (error) {}
  }
  return list;
})();

export const validateFileUrlDomain = (url: string): boolean => {
  try {
    // Allow all URLs if the whitelist is empty
    if ((global.systemEnv?.fileUrlWhitelist || []).length === 0) {
      return true;
    }

    const whitelistArray = [...(global.systemEnv?.fileUrlWhitelist || []), ...systemWhiteList];

    const urlObj = new URL(url);

    const isAllowed = whitelistArray.some((domain) => {
      if (!domain || typeof domain !== 'string') return false;
      return urlObj.hostname === domain;
    });

    if (!isAllowed) {
      return false;
    }

    return true;
  } catch (error) {
    return true;
  }
};