apply security audit

backend/src/services/bookstack.service.ts

@@ -32,6 +32,47 @@ export interface BookStackSearchResult {
   tags: { name: string; value: string; order: number }[];
 }
 
+/**
+ * Validates that a URL is safe to use as an outbound service endpoint.
+ * Rejects non-http(s) protocols and private/loopback IP ranges to prevent SSRF.
+ */
+function isValidServiceUrl(raw: string): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return false;
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return false;
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+
+  // Reject plain loopback / localhost names
+  if (hostname === 'localhost' || hostname === '::1') {
+    return false;
+  }
+
+  // Reject numeric IPv4 private / loopback / link-local ranges
+  const ipv4Parts = hostname.split('.');
+  if (ipv4Parts.length === 4) {
+    const [a, b] = ipv4Parts.map(Number);
+    if (
+      a === 127 ||                         // 127.0.0.0/8  loopback
+      a === 10 ||                          // 10.0.0.0/8   private
+      (a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12 private
+      (a === 192 && b === 168) ||          // 192.168.0.0/16 private
+      (a === 169 && b === 254)             // 169.254.0.0/16 link-local
+    ) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
 function buildHeaders(): Record<string, string> {
   const { bookstack } = environment;
   return {
@@ -42,8 +83,8 @@ function buildHeaders(): Record<string, string> {
 
 async function getRecentPages(): Promise<BookStackPage[]> {
   const { bookstack } = environment;
-  if (!bookstack.url) {
-    throw new Error('BOOKSTACK_URL is not configured');
+  if (!bookstack.url || !isValidServiceUrl(bookstack.url)) {
+    throw new Error('BOOKSTACK_URL is not configured or is not a valid service URL');
   }
 
   try {
@@ -73,8 +114,8 @@ async function getRecentPages(): Promise<BookStackPage[]> {
 
 async function searchPages(query: string): Promise<BookStackSearchResult[]> {
   const { bookstack } = environment;
-  if (!bookstack.url) {
-    throw new Error('BOOKSTACK_URL is not configured');
+  if (!bookstack.url || !isValidServiceUrl(bookstack.url)) {
+    throw new Error('BOOKSTACK_URL is not configured or is not a valid service URL');
   }
 
   try {