@moonpay/platform-sdk-core 1.3.0 → 1.4.0

package/dist/index.cjs

@@ -45,8 +45,23 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/api/client-context.ts
+var DEFAULT_API_BASE_URL = "https://api.moonpay.com";
+function isTrustedMoonPayUrl(value) {
+  let hostname;
+  let protocol;
+  try {
+    ({ hostname, protocol } = new URL(value));
+  } catch {
+    return false;
+  }
+  if (hostname === "localhost" || hostname === "127.0.0.1")
+    return true;
+  if (protocol !== "https:")
+    return false;
+  return hostname === "moonpay.com" || hostname.endsWith(".moonpay.com") || hostname === "moonpay.dev" || hostname.endsWith(".moonpay.dev") || hostname === "moonpay-dev.com" || hostname.endsWith(".moonpay-dev.com") || hostname === "moonpaycloud.com" || hostname.endsWith(".moonpaycloud.com");
+}
 function createClientContext(options = {}) {
-  const { apiBaseUrl = "https://api.moonpay.com" } = options;
+  const apiBaseUrl = options.apiBaseUrl && isTrustedMoonPayUrl(options.apiBaseUrl) ? options.apiBaseUrl : DEFAULT_API_BASE_URL;
   let _accessToken = "";
   let _clientToken = "";
   return {
@@ -63,14 +78,14 @@ function createClientContext(options = {}) {
       _clientToken = token;
     },
     fetch(url, options2) {
+      const resolvedUrl = url.startsWith("http") ? url : `${apiBaseUrl}${url}`;
       const headers = {
         "Content-Type": "application/json",
         ...options2?.headers
       };
-      if (_accessToken) {
+      if (_accessToken && isTrustedMoonPayUrl(resolvedUrl)) {
         headers.Authorization = `Bearer ${_accessToken}`;
       }
-      const resolvedUrl = url.startsWith("http") ? url : `${apiBaseUrl}${url}`;
       return fetch(resolvedUrl, { ...options2, headers });
     }
   };