@strapi/admin 5.0.0-beta.14 → 5.0.0-beta.16

package/dist/server/index.mjs

@@ -22,6 +22,8 @@ import tsUtils from "@strapi/typescript-utils";
 import { z } from "zod";
 import compose from "koa-compose";
 import { strapi as strapi$1 } from "@strapi/data-transfer";
+import isLocalhostIp from "is-localhost-ip";
+import punycode from "punycode/";
 const getService = (name2) => {
   return strapi.service(`admin::${name2}`);
 };
@@ -4956,7 +4958,22 @@ const user = {
 const urlRegex = /^(?:([a-z0-9+.-]+):\/\/)(?:\S+(?::\S*)?@)?(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9_]-*)*[a-z\u00a1-\uffff0-9_]+)(?:\.(?:[a-z\u00a1-\uffff0-9_]-*)*[a-z\u00a1-\uffff0-9_]+)*\.?)(?::\d{2,5})?(?:[/?#]\S*)?$/;
 const webhookValidator = yup.object({
   name: yup.string().required(),
-  url: yup.string().matches(urlRegex, "url must be a valid URL").required(),
+  url: yup.string().matches(urlRegex, "url must be a valid URL").required().test(
+    "is-public-url",
+    "Url is not supported because it isn't reachable over the public internet",
+    async (url) => {
+      if (process.env.NODE_ENV !== "production") {
+        return true;
+      }
+      try {
+        const parsedUrl = new URL(punycode.toASCII(url));
+        const isLocalUrl = await isLocalhostIp(parsedUrl.hostname);
+        return !isLocalUrl;
+      } catch {
+        return false;
+      }
+    }
+  ),
   headers: yup.lazy((data) => {
     if (typeof data !== "object") {
       return yup.object().required();