Harden API URL Input Validation and SSRF Protections in Shared Middleware

[Chintanpatel24]

This PR strengthens API request handling by hardening URL parsing and host validation in the shared middleware.

Changes included:

• Replaced permissive URL normalization with strict parsing/validation.
• Restricted protocols to HTTP/HTTPS and rejected credentialed URLs.
• Added protection against localhost/private/reserved IP targets to reduce SSRF risk.
• Introduced API_ALLOW_PRIVATE_TARGETS=true as an explicit self-host override.
• Fixed Vercel disabled-mode flow to return immediately after sending 503.
• Standardized client-facing error codes (400 for invalid input, 408 for timeouts).

Impact :

• Improves security posture for public deployments.
• Reduces ambiguous failures from malformed inputs.
• Improves handler robustness without changing docs or broad app behavior.

[netlify]

✅ Deploy Preview for web-check ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	04a214e
🔍 Latest deploy log	https://app.netlify.com/projects/web-check/deploys/69ca5b97d64d420007c2760c
😎 Deploy Preview	https://deploy-preview-288--web-check.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This PR hardens the shared API middleware’s url query parameter handling by adding stricter URL parsing/validation and introducing initial SSRF guardrails, while also refining platform handler behavior and error status mapping.

Changes:

• Replaced permissive URL normalization with strict parsing/validation (scheme allowlist, no credentials, length/control-char checks).
• Added host blocking for localhost/private/reserved IPs with an opt-out via API_ALLOW_PRIVATE_TARGETS=true.
• Improved handler robustness (Vercel disabled-mode now returns immediately; error mapping uses error.statusCode and 408 for timeouts).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread

[Chintanpatel24]

@copilot apply changes based on the comments in this thread